Securing VMware vSphere - Mastering VMware vSphere 5.5 - page 474

➢ ➢

Virtual Machine Coni guration Raw Device

➢

Resource Assign Virtual Machine To Resource Pool

These permissions allow the VMCreator role to only create new VMs, not clone existing
VMs or deploy from templates. Those actions would require additional privileges. For
example, to allow this role to create new VMs from existing VMs, you would add the fol-
lowing privileges to the VMCreator role:

➢ ➢

Virtual Machine Inventory Create From Existing

➢ ➢

Virtual Machine Provisioning Clone Virtual Machine

➢ ➢

Virtual Machine Provisioning Customize

5. Add a permission on a folder, datacenter, cluster, or host for the Windows-based group
(IT-Provisioning in our example) with the VMCreator role.

If you don't assign the role to a datacenter object, then you'll need to assign it separately
to a folder in the VMs And Templates view. Otherwise, you'll run into an error when try-
ing to create the VM.

Similarly, if you don't assign the role to the datacenter object, then the group won't have
permission on any datastore objects. Datastore objects are children of the datacenter
object, so permissions applied to a datacenter object will, by default, propagate to the
datastores. Without permissions on at least one datastore object (either via propagation or
via direct assignment), you'll end up unable to create a new VM because you can't choose
a datastore in which to store the VM.

6. If you want or need the Windows-based group to see other objects within the vCenter
Server hierarchy, then assign the group the Read-Only role on the applicable objects.

For example, if the group should see all objects within the datacenter, add the Read-Only
role on the datacenter object.

At this point, the privileges for creating a VM are complete; however, the IT-Provisioning
group does not have the rights to mount a CD/DVD image and therefore cannot install a guest
OS. Therefore, more permissions are required to allow the IT-Provisioning group to not only
create the VMs and put them in the right place within vCenter Server but also to install the
guest OS within those VMs.
Perform the following steps to allow the Windows-based IT-Provisioning group to install a
guest OS from a CD/DVD image i le:

1. Use the vSphere Web Client to connect to a vCenter Server instance. Log in with a user
account that has been assigned the Administrator role within vCenter Server.

2. On the Home screen, click the Roles icon.

3. Create a new role named GOS-Installers .