Roles and asset privacy settings for data source definitions

Roles and the asset privacy setting control what actions you can take for data source definitions and what connections you can see on the Connections assignments tab.

To use data source definitions, confirm that you have the required roles.

Step 1: Confirm that you have the required role for the Platform assets catalog

Each task requires either the Admin or Editor or Viewer role for the Platform assets catalog. For information, see Creating the Platform assets catalog.

Step 2: Confirm that you have the required IBM Cloud IAM role

You need one of the following IBM Cloud IAM roles:

CloudPak Data Source Creator: Create data source definitions and add endpoints from connections to data source definitions for connections that the user has access to.
CloudPak Data Source Administrator: Create data source definitions and add endpoints from connections to data source definitions for connections that the user has access to. In addition, view the list of connections across the account on the Connection assignments tab.

Follow these steps to confirm that you have one of these IBM Cloud IAM roles:

From the Cloud Pak for Data as a Service navigation menu, go to Administration > Access (IAM) and log in to IBM Cloud.
From the IBM Cloud navigation menu, select Roles.

If you do not see the roles CloudPak Data Source Creator or CloudPak Data Source Administrator, you can create a custom role.

Click Create.
In the Create a custom role dialog box, enter values for the Name, ID, and optional Description.
For Service, select IBM Cloud Pak for Data as a Service.
In the View the actions selection, select either cp4d.data-source-definitions.create or cp4d.data-source-definitions.manage.
Click Add, and then Create.

For more information, see Creating custom user access roles in IBM Cloud IAM.

Step 3: Control access to the public asset after you create the data source definition (optional)

By default, when you create a data source definition, it is a public asset in the Platform assets catalog. To do certain tasks, you must be the owner or editor of the data source definition asset. If you want to change the role associated with a data source definition, add members to the asset, or make the asset private, see Controlling access to an asset in a catalog.

Required roles and asset privacy settings and where you use them

Depending on the combination of your Platform assets catalog access, role associated with the data source definition, IBM Cloud IAM role, and asset privacy settings, you can create, edit data source definitions and the endpoints, deactivate, delete, or view data source definitions.

The following sections show the required roles and asset privacy settings for creating, editing, deactivating, deleting, and viewing data source definitions.

Create a data source definition

The following table describes where you create a data source definition and the required roles.

Required roles to create a data source definition.
Where you do this task	Platform assets catalog role	IBM Cloud IAM role
- Data source definitions tab: New data source definition button. - Connection assignments tab: Select a connection and then click Add to data source definition > Create new. See also Connection assignments tab.	One of the following: - Editor - Admin	One of the following: - CloudPak Data Source Creator - CloudPak Data Source Administrator

Edit a data source definition

The following table describes where you can edit a data source definition and its endpoints, the required roles and asset privacy setting.

Required roles and asset privacy setting to edit a data source definition.
Where you do this task	Platform assets catalog role	IBM Cloud IAM role	Asset privacy setting
- Data source definitions tab: Click the data source definition name or select Edit from the overflow menu . - Connection assignments tab: Select a connection and then click Add to data source definition > Add to existing. See also Connection assignments tab.	The role depends on the asset privacy setting of the data source definition.	One of the following: - CloudPak Data Source Creator - CloudPak Data Source Administrator	If the data source definition is a private asset, you must have the following role and ownership: - Editor or Admin role for the Platform assets catalog - Be the owner or editor of data source definition asset If the data source definition is a public asset (default), you must have one of the following combinations of role and ownership: - Admin or Editor role for the Platform assets catalog and be the owner or editor of the data source definition asset. You can also edit the endpoints. - Admin role for the Platform assets catalog and no ownership of the data source definition asset. You can't see or edit the endpoints. - Admin role for the Platform assets catalog and be the viewer of the data source definition asset. You can view but can't edit the endpoints.

Deactivate or delete a data source definition

The following table describes where you can deactivate or delete a data source definition and the required roles and asset privacy setting.

Required roles and asset privacy setting to deactivate or delete a data source definition.
Where you do this task	Platform assets catalog role	IBM Cloud IAM role	Asset privacy setting
Data source definitions tab: Open the overflow menu for the data source definition, and then select Deactivate or Delete.	The role depends on the asset privacy setting of the data source definition.	One of the following: - CloudPak Data Source Creator - CloudPak Data Source Administrator	If the data source definition is a private asset, you must have the following role and ownership: - Editor or Admin role for the Platform assets catalog - Be the owner or editor of data source definition asset If the data source definition is a public asset (default), you must have one of the following combinations of role and ownership: - Admin role for the Platform assets catalog Or - Editor role for the Platform assets catalog - Be the owner or editor of the data source definition asset

View the list of data source definitions on the Data source definitions tab

To view the list of data source definitions on the Data source definitions tab, you must have the following roles.

Required roles to see data source definitions on the Data source definitions tab.
Platform assets catalog role	Data source definition role
One of the following: - Viewer - Editor - Admin	One of the following to also see the endpoints: - Viewer - Editor - Owner

View the list of connections on the Connection assignments tab

To view the connections on the Connection assignments tab, you must have the following roles.

Required roles to see connections on the Connection assignments tab.
Platform assets catalog role	Data source definition role
One of the following: - Viewer - Editor - Admin	One of the following to also see the endpoints: - Viewer - Editor - Owner

The connections are identified by Connection ID. If you have the CloudPak Data Source Administrator role, you can see all connections with the ID shown, with the filter option to see only the connections that you have access to, in which case the connection name is shown. Select the Additional filters Filter icon , and then Show only: Connections that you have access to.

If you don't have the CloudPak Data Source Administrator role, you can see only the connections that you have access to and then only the connection name is shown.