IAM roles - CoreWeave Docs

A role is the unit of access you assign in a policy rule. Each role grants a fixed set of actions. Most services have a Viewer role for read-only access and an Admin role for full management. Assign the least privileged role that lets a principal do their job. The following roles are grouped by functional area to help you pick the right one. The description states what the role grants. The “When to assign” column suggests who typically needs it.

These roles apply to CoreWeave Infrastructure, not Forge. Forge roles belong to a separate identity and access system. See Forge and CoreWeave identity.

Access control and IAM

These roles manage identities, groups, access policies, and personal access tokens.

Name	Role description	When to assign
IAM Viewer	Read-only visibility across IAM configuration (for example, view organization user permitted actions, SAML configuration, AUP provisioning, API tokens, groups and memberships).	Assign to anyone who needs to review users, groups, and access policies without changing them.
IAM Admin	Administrative control over IAM: invite and revoke users, create, delete, and update groups and memberships, and configure identity integrations (for example, SAML SSO, AUP provisioning, API tokens).	Assign to administrators who manage users, groups, and identity integrations for the organization.
Access Token Viewer	Read-only visibility into personal access tokens (list and view).	Assign to users who need to see their personal access tokens but not create or delete them.
Access Token User	Full management of personal access tokens: create and delete tokens for the current user as permitted by org policy.	Assign to users who need to create and delete their own API access tokens.
Access Request Approver	Approves or denies privileged access requests. Can view the list of pending Service Account Management access requests.	Assign to people who approve support and privileged access requests. Because approved access expires after 8 hours, assign the role to multiple approvers so requests can be reviewed promptly.

On 2026-10-07, the Access Token Admin role was renamed to Access Token User. Only the display name changed. The role still lets users create and delete their own API access tokens, subject to organization policy.

CKS clusters

These roles manage CoreWeave Kubernetes Service clusters and VPC resources.

Name	Role description	When to assign
CKS Viewer	Read-only visibility into Kubernetes resources: list and view clusters and VPC resources.	Assign to engineers who need to inspect clusters and VPC resources but not change them.
CKS Admin	Administrative control over Kubernetes resources: create, update, and delete clusters and VPC resources.	Assign to engineers who create and manage clusters and VPC resources.

Inference

These roles manage inference gateways, deployments, capacity claims, and hot-loads.

Name	Role description	When to assign
Inference Viewer	Read-only visibility into inference resources: list and view gateways, deployments, capacity claims, and hot-loads, including hot-load replica status.	Assign to users who need to monitor inference resources without changing them.
Inference Admin	Administrative control over inference resources: create, update, and delete gateways, deployments, and capacity claims; create hot-loads. Includes Inference Viewer permissions.	Assign to engineers who deploy and manage inference workloads.

Sandbox

These roles manage CoreWeave Sandboxes policies, runners, registered Volumes, and sandbox execution. Sandbox User and Sandbox Admin apply only to customers using CoreWeave access tokens. These roles do not apply to customers using Forge API keys.

Name	Role description	When to assign
Sandbox User	Create and operate sandboxes governed by policies, and list, read, validate, and mount registered Volumes.	Assign to researchers and engineers who run sandboxes and use registered Volumes.
Sandbox Admin	Manage sandbox policies and create, update, and delete runners. Register, update, and delete Volumes. On runners using legacy `v1beta2` profiles, enable privileged profile settings. These settings include privileged containers, host namespaces, and host filesystem mounts that can give sandboxes access to their Nodes. Includes Sandbox User permissions.	Assign to administrators who manage sandbox policies, runners, and registered Volumes. Legacy privileged profile settings can give sandboxes Node access comparable to that of a cluster administrator.

Bare metal

These roles manage the CoreWeave Bare Metal Service (limited availability), including BMC serial console access to nodes. Contact support to request access.

Name	Role description	When to assign
Baremetal Viewer	Read-only visibility into bare metal pools and nodes: list and view configurations.	Assign to users who need to inspect bare metal resources but not change them.
Baremetal Admin	Administrative control over bare metal resources: create, update, and delete pools, and reboot or reconfigure nodes.	Assign to administrators who provision and manage bare metal pools and nodes.
Baremetal Node Console Viewer	Read-only access to a node’s BMC serial console: view console output only. Input from the client is dropped.	Assign to users who need to observe boot and console output for troubleshooting.
Baremetal Node Console Admin	Full bidirectional access to a node’s BMC serial console, including sending input.	Assign to administrators who need interactive console access for boot debugging.

Object storage

The Object Storage Admin role governs CoreWeave AI Object Storage control-plane actions in the AI Object Storage API, not bucket or object operations through the S3-compatible API. To create or delete buckets, or to work with objects, a user also needs an organization access policy. The policy must include the user as a principal and allow the required s3: actions, such as s3:CreateBucket or s3:DeleteBucket. To learn how organization and bucket access policies are evaluated, see About policies.

Name	Role description	When to assign
Object Storage Admin	Full access to AI Object Storage `cwobject:` control-plane actions, including managing organization access policies and creating, revoking, and listing access keys. It doesn’t grant S3-compatible API actions, such as creating or deleting buckets.	Assign to administrators who manage Object Storage credentials and organization-level control-plane configuration.

Observability and telemetry

These roles cover organization custom dashboards, observability data, and Telemetry Relay configuration. Dashboard permissions are separate from access to metrics and logs. The Grafana Dashboard roles apply to your organization’s custom dashboards and don’t control access to CoreWeave-provided dashboards.

Name	Role description	When to assign
Grafana Dashboard Viewer	Read-only access to your organization’s custom dashboards.	Assign to users who need to view custom dashboards.
Grafana Dashboard Editor	Write access to your organization’s custom dashboards. Requires Grafana Dashboard Viewer.	Assign together with Grafana Dashboard Viewer to users who create and edit custom dashboards.
Observability Viewer	Read-only access to metrics and logs for troubleshooting and performance monitoring.	Assign to engineers who need to query observability data.
Telemetry Relay Reader	Read-only visibility into Telemetry Relay: list and view forwarding endpoints, pipelines, and telemetry streams.	Assign to users who need to review Telemetry Relay endpoints and pipelines without changing them.
Telemetry Relay Admin	Administrative control over Telemetry Relay: create, update, and delete forwarding endpoints and pipelines. Includes Telemetry Relay Reader permissions.	Assign to engineers who configure log forwarding to external endpoints.

Billing

This role grants read-only access to billing data.

Name	Role description	When to assign
Billing Viewer	Read-only access to billing data, including viewing the billing dashboard, current balance, and listing and downloading invoices.	Assign to users who need to review balances and invoices.

Alerts and integrations

These roles manage alert subscriptions and the destinations that receive them.

Name	Role description	When to assign
Alerts Viewer	Read-only access to alert history, notification delivery statuses, and the alert configuration page.	Assign to users who need to review alerts and delivery status without changing subscriptions.
Alerts Admin	Manage which alerts the organization receives and where they are delivered: subscribe and unsubscribe alerts per destination on the alert configuration page. Includes Alerts Viewer permissions.	Assign to users who manage which alerts the organization receives and where they go.
Integrations Viewer	Read-only visibility into notification destinations and credentials, including the Integrations page and the destinations list on the alert configuration page.	Assign to users who need to review notification destinations without changing them.
Integrations Admin	Full management of notification destinations and credentials: create, update, and delete Slack and webhook integrations. Includes Integrations Viewer permissions.	Assign to users who configure Slack and webhook destinations for alerts.

Support

This role grants read-only access to support records.

Name	Role description	When to assign
Support Viewer	Read-only access to support tickets and records in the integrated support system (Freshdesk).	Assign to users who need to review the organization’s support tickets.

Administrators can manage resources in the Cloud Console, the API, and with infrastructure-as-code (IaC) tools like Terraform.

Legacy group role assignments

Before IAM Access Policies, user permissions were determined by the legacy group a user belonged to. The following table shows how each legacy group maps to the new IAM roles:

CoreWeave legacy group	Corresponding IAM roles
`admin`	IAM Admin, CKS Admin, Object Storage Admin, Access Token User, Access Request Approver
`write`	CKS Admin, Object Storage Admin, Access Token User
`read`	IAM Viewer, CKS Viewer, Access Token Viewer
`metrics`	Observability Viewer
`billing_viewer`	Billing Viewer

Roles added for newer platform features may not be automatically included in legacy admin policies. If you expect access to a feature but can’t reach it, check your organization’s access policies and add the relevant role if it’s missing. You can review and modify these role assignments or create new groups with different role combinations using IAM Access Policy management.

Next steps

Learn about IAM Access Policies.
Create an IAM Access Policy.

​Access control and IAM

​CKS clusters

​Inference

​Sandbox

​Bare metal

​Object storage

​Observability and telemetry

​Billing

​Alerts and integrations

​Support

​Legacy group role assignments

​Next steps

Access control and IAM

CKS clusters

Inference

Sandbox

Bare metal

Object storage

Observability and telemetry

Billing

Alerts and integrations

Support

Legacy group role assignments

Next steps