Edit: Add additional privileges for VASA provider (StorageViews)
I can't attach the script file, so we'll see how the copy/paste does.
#
# PowerCLI script to create Custom Role which includes required permissions
# and assign Custom Service Account to Role
# Usage Create_Custom_Role.ps1 -vCenter vCenterFQDNorIP -Username ServiceAccountName -Domain AuthenticationDomain -RoleName CustomRoleName
# The user account must already exist, this script will not create the user account.
# Original Script Author vHersey
# Link to original script: http://www.vhersey.com/2015/06/17/powercli-create-vcenter-role-and-assign-user-permissions/
# Get Commandline Parameters - All are required
param(
[string]$vCenter,
[string]$Username,
[string]$Domain,
[string]$RoleName
)
clear-host
$usage = "Create_Custom_Role.ps1 -vCenter vCenterFQDNorIP -Username CustomServiceAccountName -Domain AuthenticationDomain -RoleName CustomRoleName"
$example = 'Create_Custom_Role.ps1 -vCenter "vcenter.acme.local" -Username svtuser -Domain acme -RoleName CustomRoleName'
Write-Host "PowerCLI script to create Custom Role which includes required privileges and assigns the Custom Service Account to Role" -ForeGroundColor Cyan
if ( !$vCenter -or !$Username -or !$Domain -or !$RoleName ) {
write-host `n `n"Missing Required Parameter - vCenter, Username, Domain, and RoleName are required." `n -ForeGroundColor Red
write-host "Usage: $usage" `n
write-host "Example: $example" `n
exit
}
write-host "vCenter: $vCenter"
write-host "User: $Username"
write-host "Domain: $Domain"
write-host "RoleName: $RoleName"
$vCenterFQDN = $vCenter
# Custom Service Account User
#The Custom User account is a non-login, privileged, vCenter Server account that you specify during deployment. OmniCube uses this account to execute privileged tasks.
$Custom_User = "$Domain\$Username"
# Custom Role Name
#Edit - No a paramater
#$Custom_Role = "Custom"
# Privileges to assign to role
# See the product Administrators Guide for Required Permissions
# Nimble vCenter Privileges
$Custom_Privileges = @(
'Datastore.AllocateSpace',
'Datastore.Config',
'Datastore.Delete',
'Datastore.Move',
'Datastore.Rename',
'Extension.Register',
'Extension.Unregister',
'Extension.Update',
'Global.CancelTask',
'Host.Config.AdvancedConfig',
'Host.Config.NetService',
'Host.Config.Settings',
'Host.Config.Storage',
'StoragePod.Config',
'StorageViews.ConfigureService',
'StorageViews.View',
'System.Anonymous',
'System.Read',
'System.View',
'Task.Create',
'Task.Update')
# Original Script Simplivity Privileges
# 'Alarm.Create',
# 'Alarm.DisableActions',
# 'Alarm.Edit',
# 'Alarm.SetStatus',
# 'Alarm.Delete',
# 'Extension.Register',
# 'Extension.Update',
# 'Extension.Unregister',
# 'Global.Health',
# 'Global.LogEvent',
# 'Global.ManageCustomFields',
# 'Global.SetCustomField',
# 'Global.Diagnostics',
# 'Host.Cim.CimInteraction',
# 'Task.Create',
# 'Task.Update',
# 'VApp.AssignVApp',
# 'VApp.Unregister',
# 'VApp.ApplicationConfig',
# 'VirtualMachine.Config.ManagedBy',
# 'VirtualMachine.Config.Settings',
# 'VirtualMachine.State.RemoveSnapshot',
# 'VirtualMachine.State.CreateSnapshot'
Write-Host "Connecting to vCenter at $vCenterFQDN"`n -ForeGroundColor Cyan
Connect-VIServer $vCenterFQDN | Out-Null
Write-Host "Create New $RoleName Role"`n -ForeGroundColor Cyan
New-VIRole -Name $RoleName -Privilege (Get-VIPrivilege -id $Custom_Privileges) | Out-Null
Write-Host "Set Permissions for $Custom_User using the new $RoleName Role"`n -ForeGroundColor Cyan
#Get the Root Folder
$rootFolder = Get-Folder -NoRecursion
#Create the Permission
New-VIPermission -Entity $rootFolder -Principal $Custom_User -Role $RoleName -Propagate:$true | Out-Null
#Disconnect from the vCenter Server
Write-Host "Disconnecting from vCenter at $vCenterFQDN"`n -ForeGroundColor Cyan
Disconnect-VIServer $vCenterFQDN -Confirm:$false
#End
.png)
