Assigning user with multiple roles or multiple external user groups

Enterprises are getting complex and role of a FinOps, DevOps or SRE is getting more fragmented. With this direction in the organization, a FinOps team member may want to have a readonly/observer privilege on all the resources, but more actionable privilege on systems that are part of the FinOps team to optimize and run application at its peak performance. This means the user need two separate level of permission.

Two ways to achieve

One going to be very granular and flexible, but can be complicated to implement. In this approach each role can be setup to have permission per group that is scoped for that role. This means an organizational role that is for FinOps will have multiple groups assigned and for each group different privileges are given. Example: FinOps-Role1 will have all groups assigned (can be tag based or an option with 'all' group to eliminate maintenance activity when a new group is created or new account is added) and observer privilege is assigned for all. FinOps-Role2 will have everything as FinOps-Role1 and a override on the FinOps group with automator privilege.

Second approach will be to allow assigning more than one external user group to a user. In this case, Turbonomic administrator will create two external groups, FinOpsObserver who can view entire organizational resource and FinOpsAutomator who can take action on FinOps resrouces. These groups can be assigned individually or together to a user giving them just observer privilege or observer for all and automator for FinOps systems