Skip to content

Getting started

Projects, users and roles

Everything you build on Breqwatr Cloud lives in a project. Projects belong to an organisation, and each person's role in the organisation decides what they can do.

How they fit together

What it is On a traditional virtualization platform
Organisation Your team's home: its people, its billing and its projects The tenant or customer account
Project A container for cloud resources: instances, volumes, networks, load balancers, clusters A resource pool or folder with its own permissions
Member A person in the organisation, with one role A user account with a role assignment

An organisation can have as many projects as it needs. Each project keeps its own resources, its own quota in each region, and its own invoice, so projects are how resources, limits and spend are kept apart.

One person can belong to more than one organisation, with a different role in each.

Roles

Every member of an organisation has one of three roles.

Member Admin Owner
Create, change and delete resources in projects they can access Yes Yes Yes
Create and edit projects No Yes Yes
Delete projects No No Yes
Invite and remove members No Yes, except the owner Yes
Change roles and transfer ownership No No Yes
See billing and request quota increases No Yes Yes
Restrict members to specific projects No No Yes

An organisation has exactly one owner at a time. If you signed up on your own, that's you.

Create a project

A new organisation has no projects. Complete your billing details and add a payment method before you create your first project. An owner or admin fills in Billing → Settings → Billing Details, then adds a card in Billing → Settings → Payment Methods → Add card. Quotas and your bill covers billing.

  1. Open the organisation's Projects page from the side navigation.
  2. Choose New project.
  3. Enter a Name and, optionally, a Description, and choose Create project.

The project is ready to use in a few moments. In each region it's used in, it gets a network called default, with a subnet and a router to the internet; Networking model explains what that gives you.

Delete a project

Only the owner can delete a project, and only once it has no instances or volumes left in any region. On the Projects page, choose Delete on the project's row and confirm. Deleting a project is permanent: its snapshots and networking go with it.

Invite people

Owners and admins invite people from the organisation's Team page:

  1. In Invite a member, enter the person's Email and choose a Role: Member or Admin.
  2. Choose Send invite.

The person accepts the invitation from the email, then signs in, or signs up if they're new. Like every account, theirs uses MFA; see Your account and MFA. To make someone the owner, the current owner transfers ownership to an existing member.

Limit which projects members see

By default, every member of an organisation can see every project. The owner can restrict members to the projects they need:

  1. In the organisation's Settings, find Project access and tick Restrict member access to specific projects, then save.
  2. On the Team page, choose Manage on a member's row and tick the projects they should see.

Turning the restriction on keeps everyone's current access, so nothing changes until you narrow it. Owners and admins always see every project.

Impact

  • People get the access their role needs, and no more.
  • Separate projects keep resources, quotas and invoices apart, so one project's changes don't affect another's.
  • The audit log records changes to members, roles, projects and organisation settings; see Operational excellence.

Common anti-patterns

  • Everyone an admin: admins can invite and remove people and manage projects. Building and running resources needs only the Member role.
  • Shared accounts: several people signing in as one. Every action in the audit log then has the same name on it. Invite each person instead.
  • One project for everything: every workload shares one quota and one invoice, so nobody can tell which part grew.

Next

Application credentials and clouds.yaml sets up access for the CLI, OpenTofu and Ansible.

Further reading