Managing Roles
This section describes the roles and permissions associated with Checkmarx One.
Checkmarx One user management has three types of roles:
Checkmarx One roles are divided into Action roles and Composite roles.
Action roles are single actions that define a user's permissions for actions in Checkmarx One.
Composite roles are roles with one or more Action roles associated with them.
When a composite role is mapped to a user, the user gains the associated roles.
This inheritance is continuous, so a composite of composites also gets inherited.
Identity and Access Management (IAM) roles - System roles.
Composite Roles
A composite role aggregates multiple actions into 1 role type.
For example:
The ast-viewer role lets the user view all project-related data, including:
View Projects
View scans
View scan results
Checkmarx IAM includes a set of out-of-the-box roles - Composite Roles.
These roles can be used in the following options:
The roles can be modified according to specific needs.
If needed, new customized composite roles can be added to the existing roles list.
The Roles screen includes the following default composite roles.
 |
Note
For more information, see Creating New Composite Roles
The following are predefined roles and their permissions in IAM:
Creating New Composite Roles
To create new composite roles, perform the following steps:
Click Create Role
Name the role and click Create Role
Write the role's Description (Optional). It is recommended you include the purpose you created the role for.
Expand the Role Mapping section.
Add roles (Composite and/or Actions) by clicking the relevant Add buttons.
Click Save Role
The new composite role is added to the composite roles list.
Action Roles
An action role is a single action role. This role type defines permissions for actions in the system.
The following table lists the action roles that are provided for Checkmarx One, along with their respective permissions:
Roles | Related Activity | Description |
|---|---|---|
create-application | Application | Create an application |
delete-application | Applications | Delete an application |
update-application | Application | Update an application |
view-applications | Application | View applications |
view-engines | Engines | View engines |
create-pool | Pool | Create a pool |
delete-pool | Pool | Delete a pool |
update-pool | Pool | Update a pool |
view-pools | Pool | View pools |
create-project | Project | Create a project |
delete-project | Project | Delete a project |
update-project | Project | Update a project |
view-projects | Project | View projects |
create-query | Query | Create a query |
delete-query | Query | Delete a query |
update-query | Query | Update a query |
view-queries | Query | View queries |
update-result | Results | Update results |
update-result-not-exploitable | Results | Update results state to Not exploitable |
view-results | Results | View results |
create-scan | Scan | Initiate a scan |
delete-scan | Scan | Delete a scan |
update-scan | Scan | Cancel a scan |
view-scans | Scan | View scans |
dast-admin | Environment | Manage Environments, Scans, update results, and execute other actions in DAST |
dast-update-scan | Environment | The user can update a Scan's properties in DAST |
dast-update-results | Environment | The user can update results in DAST (severity, comments, etc.) |
dast-create-scan | Environment | The user can create a new Scan in DAST |
dast-delete-scan | Environment | The user can delete a Scan in DAST |
dast-update-environment | Environment | The user can update an Environment in DAST |
dast-create-environment | Environment | The user can create a new Environment in DAST |
dast-external-scans | Environment | CI/CD user for executing actions related to External Workers |
dast-delete-environment | Environment | The user can delete an Environment in DAST |
dast-cancel-scan | Environment | The user can cancel a Scan in DAST |
IAM Roles
IAM roles are related to the actions available in the User and Access Management console.
The following table lists the action roles that are provided for Checkmarx One, along with their respective permissions:
Checkmarx One IAM Roles | Permissions |
|---|---|
iam-admin |
|
manage-clients | Manage O-Auth clients |
manage-keys | View, create, edit, and delete API keys |
manage-groups | Manages groups in the system |
manage-users | Manages the users in the system |