> ## Documentation Index > Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt > Use this file to discover all available pages before exploring further. # IAM roles > Reference for CoreWeave IAM roles, grouped by functional area, and how legacy groups map to them A role is the unit of access you assign in a policy rule. Each role grants a fixed set of actions. Most services have a Viewer role for read-only access and an Admin role for full management. Assign the least privileged role that lets a principal do their job. The following roles are grouped by functional area to help you pick the right one. The description states what the role grants. The "When to assign" column suggests who typically needs it. ## Access control and IAM These roles manage identities, groups, access policies, and personal access tokens. | Name | Role description | When to assign | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | IAM Viewer | Read-only visibility across IAM configuration (for example, view organization user permitted actions, SAML configuration, AUP provisioning, API tokens, groups and memberships). | Assign to anyone who needs to review users, groups, and access policies without changing them. | | IAM Admin | Administrative control over IAM: invite and revoke users, create, delete, and update groups and memberships, and configure identity integrations (for example, SAML SSO, AUP provisioning, API tokens). | Assign to administrators who manage users, groups, and identity integrations for the organization. | | Access Token Viewer | Read-only visibility into personal access tokens (list and view). | Assign to users who need to see their personal access tokens but not create or delete them. | | Access Token Admin | Full management of personal access tokens: create and delete tokens for the current user as permitted by org policy. | Assign to users who need to create and delete their own API access tokens. | | Access Request Approver | Approves or denies privileged access requests. Can view the list of pending Service Account Management access requests. | Assign to people who approve support and privileged access requests. Because [approved access expires after 8 hours](/security/support-access-management), assign the role to multiple approvers so requests can be reviewed promptly. | ## CKS clusters These roles manage CoreWeave Kubernetes Service clusters and VPC resources. | Name | Role description | When to assign | | ---------- | -------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | | CKS Viewer | Read-only visibility into Kubernetes resources: list and view clusters and VPC resources. | Assign to engineers who need to inspect clusters and VPC resources but not change them. | | CKS Admin | Administrative control over Kubernetes resources: create, update, and delete clusters and VPC resources. | Assign to engineers who create and manage clusters and VPC resources. | ## Inference These roles manage inference gateways, deployments, and capacity claims. | Name | Role description | When to assign | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | Inference Viewer | Read-only visibility into inference resources: list and view gateways, deployments, and capacity claims. | Assign to users who need to monitor inference resources without changing them. | | Inference Admin | Administrative control over inference resources: create, update, and delete gateways, deployments, and capacity claims. Includes Inference Viewer permissions. | Assign to engineers who deploy and manage inference workloads. | ## Sandbox These roles manage [CoreWeave Sandbox](/products/sandboxes) profiles, runners, and sandbox execution. | Name | Role description | When to assign | | ------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Sandbox User | Read access to sandbox profiles and runners, and the ability to create sandboxes against them. | Assign to researchers and engineers who run sandboxes but don't manage profiles or runners. | | Sandbox Admin | Full administration of sandbox resources: create, update, and delete profiles and runners. Includes Sandbox User permissions. | Assign to administrators who create and manage sandbox profiles and runners. | ## Bare metal These roles manage the CoreWeave Bare Metal Service (limited availability), including BMC serial console access to nodes. [Contact support](/support/contact) to request access. | Name | Role description | When to assign | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | Baremetal Viewer | Read-only visibility into bare metal pools and nodes: list and view configurations. | Assign to users who need to inspect bare metal resources but not change them. | | Baremetal Admin | Administrative control over bare metal resources: create, update, and delete pools, and reboot or reconfigure nodes. | Assign to administrators who provision and manage bare metal pools and nodes. | | Baremetal Node Console Viewer | Read-only access to a node's BMC serial console: view console output only. Input from the client is dropped. | Assign to users who need to observe boot and console output for troubleshooting. | | Baremetal Node Console Admin | Full bidirectional access to a node's BMC serial console, including sending input. | Assign to administrators who need interactive console access for boot debugging. | ## Object storage This role administers CoreWeave AI Object Storage control plane resources. Access to bucket data (buckets and objects) through the S3-compatible API is governed separately by [organization and bucket access policies](/products/storage/object-storage/auth-access/policies), not by this role. | Name | Role description | When to assign | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- | | Object Storage Admin | Full administration for AI Object Storage: create and delete buckets, manage organization access policies, and create, revoke, and list access keys. Includes listing buckets and ensuring and setting bucket access policies. | Assign to administrators who manage buckets, access keys, and organization access policies. | ## Observability and telemetry These roles cover observability data and Telemetry Relay configuration. | Name | Role description | When to assign | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | Observability Viewer | Read-only access to observability data (for example, cluster metrics and dashboards) for troubleshooting and performance monitoring. | Assign to engineers who monitor metrics and dashboards to troubleshoot workloads. | | Telemetry Relay Reader | Read-only visibility into Telemetry Relay: list and view forwarding endpoints, pipelines, and telemetry streams. | Assign to users who need to review Telemetry Relay endpoints and pipelines without changing them. | | Telemetry Relay Admin | Administrative control over Telemetry Relay: create, update, and delete forwarding endpoints and pipelines. Includes Telemetry Relay Reader permissions. | Assign to engineers who configure log forwarding to external endpoints. | ## Billing This role grants read-only access to billing data. | Name | Role description | When to assign | | -------------- | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- | | Billing Viewer | Read-only access to billing data, including viewing the billing dashboard, current balance, and listing and downloading invoices. | Assign to users who need to review balances and invoices. | ## Notifications and integrations These roles manage alert subscriptions and the destinations that receive them. | Name | Role description | When to assign | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | | Notifications Viewer | Read-only access to alert history, notification delivery statuses, and the alert configuration page. | Assign to users who need to review alerts and delivery status without changing subscriptions. | | Notifications Admin | Manage which alerts the organization receives and where they are delivered: subscribe and unsubscribe alerts per destination on the alert configuration page. Includes Notifications Viewer permissions. | Assign to users who manage which alerts the organization receives and where they go. | | Integrations Viewer | Read-only visibility into notification destinations and credentials, including the Integrations page and the destinations list on the alert configuration page. | Assign to users who need to review notification destinations without changing them. | | Integrations Admin | Full management of notification destinations and credentials: create, update, and delete Slack and webhook integrations. Includes Integrations Viewer permissions. | Assign to users who configure Slack and webhook destinations for alerts. | ## Support This role grants read-only access to support records. | Name | Role description | When to assign | | -------------- | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | | Support Viewer | Read-only access to support tickets and records in the integrated support system (Freshdesk). | Assign to users who need to review the organization's support tickets. | Administrators can manage resources in the Cloud Console, the API, and with infrastructure-as-code (IaC) tools like Terraform. ## Legacy group role assignments Before IAM Access Policies, user permissions were determined by the legacy group a user belonged to. The following table shows how each legacy group maps to the new IAM roles: | CoreWeave legacy group | Corresponding IAM roles | | ---------------------- | --------------------------------------------------------------------------------------- | | `admin` | IAM Admin, CKS Admin, Object Storage Admin, Access Token Admin, Access Request Approver | | `write` | CKS Admin, Object Storage Admin, Access Token Admin | | `read` | IAM Viewer, CKS Viewer, Access Token Viewer | | `metrics` | Observability Viewer | | `billing_viewer` | Billing Viewer | Roles added for newer platform features may not be automatically included in legacy admin policies. If you expect access to a feature but can't reach it, check your organization's access policies and add the relevant role if it's missing. You can review and modify these role assignments or create new groups with different role combinations using [IAM Access Policy management](/security/iam/access-policies/manage). ## Next steps * Learn about [IAM Access Policies](/security/iam/access-policies). * Create an [IAM Access Policy](/security/iam/access-policies/manage).