Symptom

A user needs permission to create, edit, and delete users without access to Fleet, Worker Group, node, or product configuration.

Self-managed Cribl Stream does not provide a built-in role with this exact scope.

Environment

• Cribl Stream 4.19.0 or later, subject to validation in the target release
• Self-managed distributed deployment with an Enterprise license
• Access to the Leader host
• Access to the operating-system account that runs Cribl
• Custom roles stored in $CRIBL_HOME/local/cribl/roles.yml

Resolution

1. Verify that the deployment is distributed and uses an Enterprise license. These prerequisites are required for RBAC.
2. SSH into the Cribl Leader.
3. Switch to the operating-system account that runs Cribl.
4. Navigate to the local Cribl configuration directory:

cd "$CRIBL_HOME/local/cribl"

5. Create or edit roles.yml.

If the file already contains custom roles, merge the following role into the existing file. Do not replace other custom roles.

user_manager:
  description: "Can create, edit, and delete users. No access to Fleet configuration."
  policy:
    # Create, edit, and delete local users.
    - "* /system/users"
    - "* /system/users/*"

    # Read roles so existing roles can be assigned.
    - "GET /system/roles"
    - "GET /system/roles/*"

    # Read teams required by the Settings UI.
    - "GET /system/teams"
    - "GET /system/teams/*"

    # Read product users required by the Settings UI.
    - "GET /products/stream/users"
    - "GET /products/edge/users"

    # Access product landing pages required for login.
    - "GET /products/stream/"
    - "GET /products/stream"
    - "GET /products/edge/"
    - "GET /products/edge"

    # Read baseline system information.
    - "GET /system/info"
    - "GET /master/summary"
    - "GET /products/stream/summary"
    - "GET /products/edge/summary"

    # Display the required Settings pages.
    - "GET /system/settings"
    - "GET /system/settings/*"

    # Perform the access checks required by the Members UI.
    - "POST /products/stream/groups/*/acl/apply"
    - "POST /products/stream/groups/*/acl/teams/apply"
    - "POST /products/edge/groups/*/acl/apply"
    - "POST /products/edge/groups/*/acl/teams/apply"

    # Display the Access Management section.
    - "GET /system/policies"
    - "GET /system/policies/*"

6. Save roles.yml.
7. Restart Cribl Stream on the Leader.
8. Sign in to Cribl Stream and navigate to Settings > Global > Access Management > Local Users.
9. Create or edit the local user who will manage other users.
10. Assign the user_manager role to the user.
11. Sign in using the delegated account and verify that it can:
    • Create users
    • Edit users
    • Delete users
12. Verify that the account cannot modify Fleet, Worker Group, node, or product configuration.

Optional Role Management

If the user must also create or modify roles, use the following version of the custom role:

user_manager:
  description: "Can create, edit, and delete users. No access to Fleet configuration."
  policy:
    - "* /system/users"
    - "* /system/users/*"
    - "* /system/roles"
    - "* /system/roles/*"
    - "GET /system/teams"
    - "GET /system/teams/*"
    - "GET /products/stream/users"
    - "GET /products/edge/users"
    - "GET /products/stream/"
    - "GET /products/stream"
    - "GET /products/edge/"
    - "GET /products/edge"
    - "GET /system/info"
    - "GET /master/summary"
    - "GET /products/stream/summary"
    - "GET /products/edge/summary"
    - "GET /system/settings"
    - "GET /system/settings/*"
    - "GET /system/policies"
    - "GET /system/policies/*"
    - "POST /products/stream/groups/*/acl/apply"
    - "POST /products/stream/groups/*/acl/teams/apply"
    - "POST /products/edge/groups/*/acl/apply"
    - "POST /products/edge/groups/*/acl/teams/apply"

Grant the additional role-management permissions only when they are required.

Cause

Self-managed Cribl Stream does not include a dedicated built-in role that grants user management without broader product administration.

Cribl Stream RBAC uses method-and-path policies. A custom role can grant access to the user-management endpoints and the supporting read and ACL permissions required by the Leader UI.

Cribl.Cloud provides the built-in org_iam_admin role for organization member and SSO administration without data-engineering access. This is not the equivalent of a built-in self-managed Cribl Stream role.