IAM roles - CoreWeave Docs

A role is the unit of access you assign in a policy rule. Each role grants a fixed set of actions. Most services have a Viewer role for read-only access and an Admin role for full management. Assign the least privileged role that lets a principal do their job. The following roles are grouped by functional area to help you pick the right one. The description states what the role grants. The “When to assign” column suggests who typically needs it.

Access control and IAM

These roles manage identities, groups, access policies, and personal access tokens.

Name	Role description	When to assign
IAM Viewer	Read-only visibility across IAM configuration (for example, view organization user permitted actions, SAML configuration, AUP provisioning, API tokens, groups and memberships).	Assign to anyone who needs to review users, groups, and access policies without changing them.
IAM Admin	Administrative control over IAM: invite and revoke users, create, delete, and update groups and memberships, and configure identity integrations (for example, SAML SSO, AUP provisioning, API tokens).	Assign to administrators who manage users, groups, and identity integrations for the organization.
Access Token Viewer	Read-only visibility into personal access tokens (list and view).	Assign to users who need to see their personal access tokens but not create or delete them.
Access Token Admin	Full management of personal access tokens: create and delete tokens for the current user as permitted by org policy.	Assign to users who need to create and delete their own API access tokens.
Access Request Approver	Approves or denies privileged access requests. Can view the list of pending Service Account Management access requests.	Assign to people who approve support and privileged access requests. Because approved access expires after 8 hours, assign the role to multiple approvers so requests can be reviewed promptly.

CKS clusters

These roles manage CoreWeave Kubernetes Service clusters and VPC resources.

Name	Role description	When to assign
CKS Viewer	Read-only visibility into Kubernetes resources: list and view clusters and VPC resources.	Assign to engineers who need to inspect clusters and VPC resources but not change them.
CKS Admin	Administrative control over Kubernetes resources: create, update, and delete clusters and VPC resources.	Assign to engineers who create and manage clusters and VPC resources.

Inference

These roles manage inference gateways, deployments, and capacity claims.

Name	Role description	When to assign
Inference Viewer	Read-only visibility into inference resources: list and view gateways, deployments, and capacity claims.	Assign to users who need to monitor inference resources without changing them.
Inference Admin	Administrative control over inference resources: create, update, and delete gateways, deployments, and capacity claims. Includes Inference Viewer permissions.	Assign to engineers who deploy and manage inference workloads.

Sandbox

These roles manage CoreWeave Sandbox profiles, runners, and sandbox execution.

Name	Role description	When to assign
Sandbox User	Read access to sandbox profiles and runners, and the ability to create sandboxes against them.	Assign to researchers and engineers who run sandboxes but don’t manage profiles or runners.
Sandbox Admin	Full administration of sandbox resources: create, update, and delete profiles and runners. Includes Sandbox User permissions.	Assign to administrators who create and manage sandbox profiles and runners.

Bare metal

These roles manage the CoreWeave Bare Metal Service (limited availability), including BMC serial console access to nodes. Contact support to request access.

Name	Role description	When to assign
Baremetal Viewer	Read-only visibility into bare metal pools and nodes: list and view configurations.	Assign to users who need to inspect bare metal resources but not change them.
Baremetal Admin	Administrative control over bare metal resources: create, update, and delete pools, and reboot or reconfigure nodes.	Assign to administrators who provision and manage bare metal pools and nodes.
Baremetal Node Console Viewer	Read-only access to a node’s BMC serial console: view console output only. Input from the client is dropped.	Assign to users who need to observe boot and console output for troubleshooting.
Baremetal Node Console Admin	Full bidirectional access to a node’s BMC serial console, including sending input.	Assign to administrators who need interactive console access for boot debugging.

Object storage

This role administers CoreWeave AI Object Storage control plane resources. Access to bucket data (buckets and objects) through the S3-compatible API is governed separately by organization and bucket access policies, not by this role.

Name	Role description	When to assign
Object Storage Admin	Full administration for AI Object Storage: create and delete buckets, manage organization access policies, and create, revoke, and list access keys. Includes listing buckets and ensuring and setting bucket access policies.	Assign to administrators who manage buckets, access keys, and organization access policies.

Observability and telemetry

These roles cover observability data and Telemetry Relay configuration.

Name	Role description	When to assign
Observability Viewer	Read-only access to observability data (for example, cluster metrics and dashboards) for troubleshooting and performance monitoring.	Assign to engineers who monitor metrics and dashboards to troubleshoot workloads.
Telemetry Relay Reader	Read-only visibility into Telemetry Relay: list and view forwarding endpoints, pipelines, and telemetry streams.	Assign to users who need to review Telemetry Relay endpoints and pipelines without changing them.
Telemetry Relay Admin	Administrative control over Telemetry Relay: create, update, and delete forwarding endpoints and pipelines. Includes Telemetry Relay Reader permissions.	Assign to engineers who configure log forwarding to external endpoints.

Billing

This role grants read-only access to billing data.

Name	Role description	When to assign
Billing Viewer	Read-only access to billing data, including viewing the billing dashboard, current balance, and listing and downloading invoices.	Assign to users who need to review balances and invoices.

Notifications and integrations

These roles manage alert subscriptions and the destinations that receive them.

Name	Role description	When to assign
Notifications Viewer	Read-only access to alert history, notification delivery statuses, and the alert configuration page.	Assign to users who need to review alerts and delivery status without changing subscriptions.
Notifications Admin	Manage which alerts the organization receives and where they are delivered: subscribe and unsubscribe alerts per destination on the alert configuration page. Includes Notifications Viewer permissions.	Assign to users who manage which alerts the organization receives and where they go.
Integrations Viewer	Read-only visibility into notification destinations and credentials, including the Integrations page and the destinations list on the alert configuration page.	Assign to users who need to review notification destinations without changing them.
Integrations Admin	Full management of notification destinations and credentials: create, update, and delete Slack and webhook integrations. Includes Integrations Viewer permissions.	Assign to users who configure Slack and webhook destinations for alerts.

Support

This role grants read-only access to support records.

Name	Role description	When to assign
Support Viewer	Read-only access to support tickets and records in the integrated support system (Freshdesk).	Assign to users who need to review the organization’s support tickets.

Administrators can manage resources in the Cloud Console, the API, and with infrastructure-as-code (IaC) tools like Terraform.

Legacy group role assignments

Before IAM Access Policies, user permissions were determined by the legacy group a user belonged to. The following table shows how each legacy group maps to the new IAM roles:

CoreWeave legacy group	Corresponding IAM roles
`admin`	IAM Admin, CKS Admin, Object Storage Admin, Access Token Admin, Access Request Approver
`write`	CKS Admin, Object Storage Admin, Access Token Admin
`read`	IAM Viewer, CKS Viewer, Access Token Viewer
`metrics`	Observability Viewer
`billing_viewer`	Billing Viewer

Roles added for newer platform features may not be automatically included in legacy admin policies. If you expect access to a feature but can’t reach it, check your organization’s access policies and add the relevant role if it’s missing. You can review and modify these role assignments or create new groups with different role combinations using IAM Access Policy management.

Next steps

Learn about IAM Access Policies.
Create an IAM Access Policy.

​Access control and IAM

​CKS clusters

​Inference

​Sandbox

​Bare metal

​Object storage

​Observability and telemetry

​Billing

​Notifications and integrations

​Support

​Legacy group role assignments

​Next steps