Creating a Custom User Group

You can create user groups with Cloud Admin or Domain Admin privileges. Once you have created a group with a specific privilege level, you cannot change that privilege level.

Cloud Admin User Privileges

• Can manage the encryption of virtual machines that have the HyTrust DataControl Policy Agent installed.
• Can create and manage Cloud VM Sets, which separate the encrypted VMs into logical groups. For example, "VMs running in AWS" or "UK Datacenter VMs". The configuration settings selected for a Cloud VM Set will automatically be applied to all VMs in that set.
• Can set options for specific VMs that override the default options specified in the Cloud VM Set.
• Can create certificates for VMs and specify key expiration dates.
• Can revoke access to individual encrypted disks/filesystems, or the whole VM. When access to disks is revoked, filesystems are forcibly unmounted, thus removing access to clear-text data.
• Can create encryption keys to securely move encrypted data between specified VMs.
• Can view audit records and alerts generated from Cloud Admin group actions.

Domain Admin User Privileges

• Can manage HyTrust KeyControl clusters by adding, removing, and authorizing KeyControl nodes.
• Can configure KeyControl node settings such as KeyControl heartbeat.
• Can view audit log records and alerts generated from Domain Admin group actions.

Procedure

1. Log into the KeyControl webGUI on any node in the cluster using an account with Security Admin privileges.
2. In the top menu bar, click Security.
3. Click the Groups tab.
4. Click Actions > Create Group.

5. In the Add New Group dialog box on the Group tab, specify the options you want to use.

   Options

   Option	Description
   Group Name	The name of the new group.
   Privilege Level	Select Cloud Admin or Domain Admin. Note: You cannot change the privilege level once a group has been created.
   Description	An optional description of the group.

6. Click Next. KeyControl verifies that the group name is unique and follows the group name requirements.

7. To add users to this group, click the Members tab and add any desired users to the Assigned Users list box. KeyControl limits the list of available users to those that have the same user role as the selected group privilege level. In other words, if you have selected Cloud Admin for Privilege Level, you only see those users assigned the Cloud Admin user role.