Introduction I created a vCenter custom role for an Aria Operations service account that can run actions. The role contains the privileges needed for the action workflow while keeping the account within least privilege.

Before You Begin

Prerequisites Before we begin, ensure you have the following:

  • Access to vCenter with administrative privileges.
  • VMware PowerCLI installed on your system.
  • Basic understanding of VMware vSphere and Aria Operations.

Connecting to vCenter with PowerCLI

Step 1: Connect to Your vCenter Server Open VMware PowerCLI and connect to your vCenter server using the following commands. Replace the placeholders with your actual login credentials and vCenter server details.

$vcServer = 'vcenter.yourdomain.com'
$username = 'administrator@yourdomain.com'
$password = 'yourPassword'
Connect-VIServer -Server $vcServer -User $username -Password $password

Defining the Required Permissions

Step 2: Define the Role and Required Permissions Define the role name and the specific permissions needed for Aria Operations to monitor the system. Here, we create a variable for the role and an array containing all necessary permissions IDs.

$permissions = @(
    "System.Anonymous",
    "System.View",
    "System.Read",
    "Global.ManageCustomFields",
    "Global.SetCustomField",
    "Global.Health",
    "Global.SystemTag",
    "Global.GlobalTag",
    "Datastore.Browse",
    "Datastore.AllocateSpace",
    "Host.Inventory.EditCluster",
    "Host.Inventory.ManageClusterLifecyle",
    "VirtualMachine.Inventory.Delete",
    "VirtualMachine.Inventory.Move",
    "VirtualMachine.Interact.PowerOn",
    "VirtualMachine.Interact.PowerOff",
    "VirtualMachine.Interact.Reset",
    "VirtualMachine.GuestOperations.Query",
    "VirtualMachine.GuestOperations.Modify",
    "VirtualMachine.GuestOperations.Execute",
    "VirtualMachine.GuestOperations.QueryAliases",
    "VirtualMachine.GuestOperations.ModifyAliases",
    "VirtualMachine.Config.CPUCount",
    "VirtualMachine.Config.Memory",
    "VirtualMachine.Config.Resource",
    "VirtualMachine.State.CreateSnapshot",
    "VirtualMachine.State.RemoveSnapshot",
    "VirtualMachine.Namespace.Management",
    "VirtualMachine.Namespace.Query",
    "VirtualMachine.Namespace.ModifyContent",
    "VirtualMachine.Namespace.ReadContent",
    "Resource.AssignVMToPool",
    "Resource.HotMigrate",
    "Resource.ColdMigrate",
    "Resource.QueryVMotion",
    "StorageProfile.Apply",
    "Performance.ModifyIntervals",
    "Extension.Register",
    "Extension.Update",
    "Extension.Unregister",
    "ExternalStatsProvider.Register",
    "ExternalStatsProvider.Update",
    "ExternalStatsProvider.Unregister",
    "vStats.QueryAny",
    "vStats.CollectAny",
    "vStats.Settings",
    "AutoDeploy.Rule.Create",
    "AutoDeploy.RuleSet.Activate",
    "AutoDeploy.Rule.Edit",
    "AutoDeploy.RuleSet.Edit",
    "StorageProfile.Update",
    "StorageProfile.View",
    "StorageViews.ConfigureService",
    "AutoDeploy.Rule.Delete",
    "StorageViews.View"
)

Creating the Role and Disconnecting

Step 3: Create the Custom Role Use the New-VIRole cmdlet to create the new role with the defined permissions. This step applies the permissions array to the role.

New-VIRole -Name $roleName -Description $roleDescription -Privilege (Get-VIPrivilege -Id $permissions)
Write-Output "Role '$roleName' created successfully with necessary permissions."

Step 4: Confirm and Disconnect After the role is successfully created, you will receive a confirmation output. Always ensure to disconnect from your vCenter server cleanly to avoid any security issues.

Disconnect-VIServer -Server $vcServer -Confirm:$false

The Complete Script

Step 5: Put it all together

$vcServer = 'vcenter.yourdomain.com'
$username = 'administrator@yourdomain.com'
$password = 'yourPassword'
Connect-VIServer -Server $vcServer -User $username -Password $password
$roleName = "Aria Operations Actions Role"
$permissions = @(
    "System.Anonymous",
    "System.View",
    "System.Read",
    "Global.ManageCustomFields",
    "Global.SetCustomField",
    "Global.Health",
    "Global.SystemTag",
    "Global.GlobalTag",
    "Datastore.Browse",
    "Datastore.AllocateSpace",
    "Host.Inventory.EditCluster",
    "Host.Inventory.ManageClusterLifecyle",
    "VirtualMachine.Inventory.Delete",
    "VirtualMachine.Inventory.Move",
    "VirtualMachine.Interact.PowerOn",
    "VirtualMachine.Interact.PowerOff",
    "VirtualMachine.Interact.Reset",
    "VirtualMachine.GuestOperations.Query",
    "VirtualMachine.GuestOperations.Modify",
    "VirtualMachine.GuestOperations.Execute",
    "VirtualMachine.GuestOperations.QueryAliases",
    "VirtualMachine.GuestOperations.ModifyAliases",
    "VirtualMachine.Config.CPUCount",
    "VirtualMachine.Config.Memory",
    "VirtualMachine.Config.Resource",
    "VirtualMachine.State.CreateSnapshot",
    "VirtualMachine.State.RemoveSnapshot",
    "VirtualMachine.Namespace.Management",
    "VirtualMachine.Namespace.Query",
    "VirtualMachine.Namespace.ModifyContent",
    "VirtualMachine.Namespace.ReadContent",
    "Resource.AssignVMToPool",
    "Resource.HotMigrate",
    "Resource.ColdMigrate",
    "Resource.QueryVMotion",
    "StorageProfile.Apply",
    "Performance.ModifyIntervals",
    "Extension.Register",
    "Extension.Update",
    "Extension.Unregister",
    "ExternalStatsProvider.Register",
    "ExternalStatsProvider.Update",
    "ExternalStatsProvider.Unregister",
    "vStats.QueryAny",
    "vStats.CollectAny",
    "vStats.Settings",
    "AutoDeploy.Rule.Create",
    "AutoDeploy.RuleSet.Activate",
    "AutoDeploy.Rule.Edit",
    "AutoDeploy.RuleSet.Edit",
    "StorageProfile.Update",
    "StorageProfile.View",
    "StorageViews.ConfigureService",
    "AutoDeploy.Rule.Delete",
    "StorageViews.View"
)
New-VIRole -Name $roleName -Privilege (Get-VIPrivilege -Id $permissions)
Write-Output "Role '$roleName' created successfully with necessary permissions."
Disconnect-VIServer -Server $vcServer -Confirm:$false

Result

The resulting role gives the Aria Operations service account only the privileges needed for action workflows. For read-only collection, use the monitoring role guide.