Skip to main content

Managing Roles

This section describes the roles and permissions associated with Checkmarx One.

Checkmarx One user management has three types of roles:

  1. Checkmarx One roles are divided into Action roles and Composite roles.

    • Action roles are single actions that define a user's permissions for actions in Checkmarx One.

    • Composite roles are roles with one or more Action roles associated with them.

      When a composite role is mapped to a user, the user gains the associated roles.

      This inheritance is continuous, so a composite of composites also gets inherited.

  2. Identity and Access Management (IAM) roles - System roles.

Composite Roles

A composite role aggregates multiple actions into 1 role type.

For example:

The ast-viewer role lets the user view all project-related data, including:

  • View Projects

  • View scans

  • View scan results

Checkmarx IAM includes a set of out-of-the-box roles - Composite Roles.

These roles can be used in the following options:

  • The roles can be modified according to specific needs.

  • If needed, new customized composite roles can be added to the existing roles list.

The Roles screen includes the following default composite roles.

Default_Composite_Roles.png

Note

For more information, see Creating New Composite Roles

The following are predefined roles and their permissions in IAM:

Creating New Composite Roles

To create new composite roles, perform the following steps:

  1. Click Create Role

  2. Name the role and click Create Role

    6195052746.png
  3. Write the role's Description (Optional). It is recommended you include the purpose you created the role for.

  4. Expand the Role Mapping section.

    Create_Role3.png
  5. Add roles (Composite and/or Actions) by clicking the relevant Add buttons.

    Create_Role4.png
  6. Click Save Role

  7. The new composite role is added to the composite roles list.

    New_Composite_Role.png

Action Roles

An action role is a single action role. This role type defines permissions for actions in the system.

The following table lists the action roles that are provided for Checkmarx One, along with their respective permissions:

Roles

Related Activity

Description

create-application

Application

Create an application

delete-application

Applications

Delete an application

update-application

Application

Update an application

view-applications

Application

View applications

view-engines

Engines

View engines

create-pool

Pool

Create a pool

delete-pool

Pool

Delete a pool

update-pool

Pool

Update a pool

view-pools

Pool

View pools

create-project

Project

Create a project

delete-project

Project

Delete a project

update-project

Project

Update a project

view-projects

Project

View projects

create-query

Query

Create a query

delete-query

Query

Delete a query

update-query

Query

Update a query

view-queries

Query

View queries

update-result

Results

Update results

update-result-not-exploitable

Results

Update results state to Not exploitable

view-results

Results

View results

create-scan

Scan

Initiate a scan

delete-scan

Scan

Delete a scan

update-scan

Scan

Cancel a scan

view-scans

Scan

View scans

dast-admin

Environment

Manage Environments, Scans, update results, and execute other actions in DAST

dast-update-scan

Environment

The user can update a Scan's properties in DAST

dast-update-results

Environment

The user can update results in DAST (severity, comments, etc.)

dast-create-scan

Environment

The user can create a new Scan in DAST

dast-delete-scan

Environment

The user can delete a Scan in DAST

dast-update-environment

Environment

The user can update an Environment in DAST

dast-create-environment

Environment

The user can create a new Environment in DAST

dast-external-scans

Environment

CI/CD user for executing actions related to External Workers

dast-delete-environment

Environment

The user can delete an Environment in DAST

dast-cancel-scan

Environment

The user can cancel a Scan in DAST

IAM Roles

IAM roles are related to the actions available in the User and Access Management console.

The following table lists the action roles that are provided for Checkmarx One, along with their respective permissions:

Checkmarx One IAM Roles

Permissions

iam-admin

  • Manages general settings, users, client credentials, identity provider, and user federation

  • iam-admin also inherits the ast-admin role (by design)

manage-clients

Manage O-Auth clients

manage-keys

View, create, edit, and delete API keys

manage-groups

Manages groups in the system

manage-users

Manages the users in the system