Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding a new role for marketplace apps #5815

Merged
merged 9 commits into from
Jul 23, 2024
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ The following are the prerequisites for dbt Cloud and Snowflake.

- You must have a dbt Cloud account on the Enterprise plan that's in an AWS Region or Azure region. If you don't already have one, please [contact us](mailto:[email protected]) to get started.
- Currently, Semantic Layer is unavailable for Azure ST instances and the **Ask dbt** chatbot will not function in the dbt Snowflake Native App without it.
- Your dbt Cloud account must have permission to create a [service token](/docs/dbt-cloud-apis/service-tokens). For details, refer to [Enterprise permissions](/docs/cloud/manage-access/enterprise-permissions).
- Your dbt Cloud account must have permission to create a [service token](/docs/dbt-cloud-apis/service-tokens) assigned the `Manage marketplace apps` role. For details, refer to [Enterprise permissions](/docs/cloud/manage-access/enterprise-permissions).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lower down on this page, we also say to grant Job Admin, Metadata, Semantic Layer Only. IS there a reason we're just mentioning this one or should we mention these as well?

https://github.com/dbt-labs/docs.getdbt.com/pull/5815/files#diff-770944d95df777c9ab980c64ab039e22058f83e3eaa322e78fca7429f397c128L71-L73

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good catch. That shouldn't be in that spot, reverting it to the way it was and relying on the below info only!

matthewshaver marked this conversation as resolved.
Show resolved Hide resolved
- There's a dbt Cloud project with [Semantic Layer configured](/docs/use-dbt-semantic-layer/setup-sl) and metrics declared.
- You have set up a [production deployment environment](/docs/deploy/deploy-environments#set-as-production-environment).
- There has been at least one successful job run that includes a `docs generate` step in the deployment environment.
Expand Down Expand Up @@ -68,6 +68,7 @@ Configure dbt Cloud and Snowflake Cortex to power the **Ask dbt** chatbot.
Collect three pieces of information from dbt Cloud to set up the application.
matthewshaver marked this conversation as resolved.
Show resolved Hide resolved

1. From the gear menu in dbt Cloud, select **Account settings**. In the left sidebar, select **API tokens > Service tokens**. Create a service token with access to all the projects you want to access in the dbt Snowflake Native App. Grant these permission sets:
- **Manage marketplace apps**
- **Job Admin**
- **Metadata Only**
- **Semantic Layer Only**
Expand Down
3 changes: 3 additions & 0 deletions website/docs/docs/dbt-cloud-apis/service-tokens.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,9 @@ Security Admin service tokens have certain account-level permissions. For more
**Billing Admin** <br/>
Billing Admin service tokens have certain account-level permissions. For more on these permissions, see [Billing Admin](/docs/cloud/manage-access/enterprise-permissions#billing-admin).

**Manage marketplace apps** <br/>
Used only for service tokens assigned to marketplace apps (for example, the [Snowflake Native app](/docs/cloud-integrations/snowflake-native-app)).

**Metadata Only**<br/>
Metadata-only service tokens authorize requests to the Discovery API.

Expand Down
31 changes: 16 additions & 15 deletions website/snippets/_enterprise-permissions-table.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,21 +14,22 @@ Account roles enable you to manage the dbt Cloud account and manage the account

#### Account permissions for account roles

| Account-level permission| Account Admin | Billing admin | Project creator | Security admin | Viewer |
|:-------------------------|:-------------:|:-------------:|:---------------:|:--------------:|:------:|
| Account settings | W | | R | R | R |
| Audit logs | R | | | R | R |
| Auth provider | W | | | W | R |
| Billing | W | W | | | R |
| Groups | W | | R | W | R |
| Invitations | W | | W | W | R |
| IP restrictions | W | | | W | R |
| Licenses | W | | W | W | R |
| Members | W | | W | W | R |
| Project (create) | W | | W | | |
| Public models | R | R | R | R | R |
| Service tokens | W | | | R | R |
| Webhooks | W | | | | |
| Account-level permission| Account Admin | Billing admin | Manage <br></br> marketplace <br></br> apps | Project creator | Security admin | Viewer |
|:-------------------------|:-------------:|:------------:|:-------------------------:|:---------------:|:--------------:|:------:|
| Account settings | W | | | R | R | R |
| Audit logs | R | | | | R | R |
| Auth provider | W | | | | W | R |
| Billing | W | W | | | | R |
| Groups | W | | | R | W | R |
| Invitations | W | | | W | W | R |
| IP restrictions | W | | | | W | R |
| Licenses | W | | | W | W | R |
| Marketplace app | | | W | | | |
| Members | W | | | W | W | R |
| Project (create) | W | | | W | | |
| Public models | R | R | | R | R | R |
| Service tokens | W | | | | R | R |
| Webhooks | W | | | | | |

#### Project permissions for account roles

Expand Down
Loading