topic Re: Grant user to create/delete snapshot only to specific volumes? in ONTAP Discussions

Grant user to create/delete snapshot only to specific volumes?

ACHOU_SIMG — Tue, 26 Jul 2016 18:50:20 GMT

Hi,

cDOT 8.3 on FAS8020

Is there a way to grant a cDOT local user to create/delete snapshots only to a specific set of volumes? I know I can create a custom role to allow only snapshot creations/deletions but is there a way to further restrict to only a set of volumes?

thanks,

Re: Grant user to create/delete snapshot only to specific volumes?

hariprak — Mon, 01 Aug 2016 10:25:42 GMT

Hi,

You can try below steps,

security login role create snapRole -cmddirname "volume snapshot" -access all -vserver <vservername>
security login role modify -role snapRole -cmddirname DEFAULT -vserver <vservername> -access none
security login create -user-or-group-name snapUser -application ontapi -authmethod password -role snapRole -vserver <vservername>

Thanks

Re: Grant user to create/delete snapshot only to specific volumes?

georgevj — Thu, 11 Aug 2016 09:41:40 GMT

You can use queries with the role create/modify command to do this. For example,

cluster::> security login role create -role testrole -vserver <vservername> -access all -cmddirname "volume snapshot" -query "-volume *abc*|nfs*"

this command will create a role that lets the user access snapshots only for volumes with names starting with "nfs" or volumes with the pattern "abc" somewhere in thier names.

Hope you understood.

Re: Grant user to create/delete snapshot only to specific volumes?

DJ-Potsdam — Tue, 13 Aug 2019 09:18:07 GMT

Hi George , thanks for the answer. I really appreciate the materials and people out there at NetApp who help customers like us to make our life easy.

Thanks a ton, cheers