Overview
Permissions control what actions a user can take in Datadog. Users are assigned to roles, and each role has a set of permissions that determines what that user can see and do.
Cloud Cost Management (CCM) uses two main permissions, cloud_cost_management_read and cloud_cost_management_write, to control access to cost data and most CCM configurations. Additional product-level permissions are available for specific features, such as editing budgets (ccm_budget_write), customizing forecast in the budgets (ccm_forecast_write), and managing report schedules (generate_ccm_report_schedules, manage_ccm_report_schedules). Assign these permissions to roles through Role Based Access Control (RBAC).
CCM also supports Data Access Control to further restrict cost data by tags.
Available permissions
| Permission | Description |
|---|
cloud_cost_management_read | Grants read-only access to view cost data, budgets, recommendations, and settings across CCM pages and external integrations. |
cloud_cost_management_write | Grants access to modify CCM configurations, including uploading custom costs and managing cloud accounts. Does not grant access to create, edit, or delete budgets; see ccm_budget_write. |
ccm_budget_write | Grants access to create, update, and delete Cloud Cost Management budgets, including budget metadata and budgeted amounts per entry. Requires the read permission to access pages. |
ccm_forecast_write | Grants access to edit custom forecast values on Cloud Cost Management budgets. Requires the read permission to access pages. |
generate_ccm_report_schedules | Grants access to view all report schedules and manage only the ones the user has created. |
manage_ccm_report_schedules | Grants access to view, create, and fully manage all report schedules across the organization. |
Permission requirements by page
The table below shows the required permissions for each CCM page and related features.
| Page/Functionality | Read Permission | Write Permission |
|---|
| CCM Summary Page | Required to view cost summary data | N/A |
| CCM Containers Page | Required to view container cost allocation data | N/A |
| CCM Recommendations Page | Required to view cost recommendations | N/A |
| CCM Explorer Page | Required to query and view cost data | N/A |
| CCM Plan Page | Required to view budgets | ccm_budget_write required to create, edit, or delete budgets |
| CCM Settings Page - Custom Costs | Required to view custom costs settings | Required to upload custom costs |
| CCM Settings Page - Tag Pipelines | Required to view tag pipelines | Required to create tag pipelines |
| CCM Settings Page - SaaS Integrations | Required to view SaaS integration settings | Required to enable integration for CCM |
| CCM Settings Page - Accounts | Required to view cloud accounts | Required to modify or create accounts |
| CCM Settings Page - Configure Recommendations | Required to view recommendation settings | Required to customize recommendations |
| Dashboards/Notebooks (external) | Required to create widgets and view cost data | N/A |
| Monitors (external) | Required to create CCM monitors | N/A |
| Service Catalog (external) | Required to view cost data | N/A |
| Resource Catalog (external) | Required to view cost data | N/A |
| API Queries for Cost Data | Required to query cost data through the API | N/A |
Data access control
Use Data Access Control to restrict access to cost data by specific tags. With this feature, you can limit teams to see only costs relevant to their resources. For example, restricting a team to view only costs tagged with team:payments or env:production.
Further reading
Additional helpful documentation, links, and articles:
