Best Practice for Restricting CI Deletion in cmdb_ci table to All user, except ecmdb_admin or admin

[Community Alums]

Hi Team, 

I need to restrict CI deletion capability in the cmdb_ci table so that only users with either the ecmdb_admin role or the admin role can delete CIs from list view and Native UI. If a user has either of these roles, they should be able to delete records. If the user does not have either of these roles, they should not have access to delete records from the cmdb_ci table from list view and Native UI. What is the best practice for implementing this requirement?

[Kieran Anson · Accepted solution]

Hi Amit,

For this you will need to modify the OOB ACLs which grant delete access to asset and itil users. There are also ACLs on child CMDB tables to which you will also need to evaluate and deactivate if they don't meet your requirement.

You can then create a new delete ACL for the cmdb_ci table with the roles you've mentioned.

For further details and to understand how ACLs are evaluated, do please watch the following video which is a great resource

https://www.youtube.com/watch?v=x-HCp6udgWU

[Kieran Anson · Accepted solution]

Hi Amit,

For this you will need to modify the OOB ACLs which grant delete access to asset and itil users. There are also ACLs on child CMDB tables to which you will also need to evaluate and deactivate if they don't meet your requirement.

You can then create a new delete ACL for the cmdb_ci table with the roles you've mentioned.

For further details and to understand how ACLs are evaluated, do please watch the following video which is a great resource

https://www.youtube.com/watch?v=x-HCp6udgWU

[surajchacherkar · Accepted solution]

Hi @Community Alums ,

agreed with Kieran Anson,

You must change the OOB ACLs that allow asset and itil users to delete data in order to accomplish this. Additionally, you will need to assess and deactivate any ACLs on child CMDB tables that do not satisfy your requirements.

After that, you may use the roles you mentioned to establish a new delete ACL for the cmdb_ci table.

If my response helped you, please click on "Accept as solution" and mark it as helpful.

Thanks

Suraj