Required Nutanix Prism Central RBAC Permissions for Parallels RAS
Background
Parallels RAS connects to Nutanix Prism Central using Nutanix v4.1 APIs to discover and manage clusters, networks, virtual machines, templates, and asynchronous tasks.
Because Nutanix role-based access control (RBAC) roles do not map exactly to the permissions used by Parallels RAS, administrators frequently ask which role should be assigned to the Prism Central provider account and whether a reduced-privilege alternative is available.
This article describes the supported account configuration and a least-privilege alternative for organizations that restrict administrative access.
Supported Configuration
To ensure full functionality and supportability, Parallels recommends using a dedicated Prism Central account with the Super Admin role.
Configure the Account
- Create a dedicated account for the Parallels RAS Prism Central provider.
- Do not use a personal administrator account.
- Assign the built-in Super Admin role in Nutanix Prism Central.
- Configure the account credentials in the Parallels RAS Nutanix Prism Central provider settings.
- Verify that Parallels RAS can connect successfully and discover:
- Clusters
- Subnets
- Virtual machines
- Templates
- Test the workflows used in your environment, including:
- Provisioning
- Cloning
- Power operations
- Template management
- Resource deletion
Important
The Super Admin role is the only permission set that has been validated end-to-end by Parallels RAS and is therefore the supported configuration.
Permissions Used by Parallels RAS
The Nutanix Prism Central provider uses the following Nutanix v4.1 API areas and permissions.
| API Area | Operations Used by RAS | Permission Type | Virtual Machine Admin Coverage |
|---|---|---|---|
| Cluster Management | List and discover clusters | Read | Yes |
| Networking | List and discover subnets | Read | Yes |
| Prism Tasks | Retrieve and monitor asynchronous task status | Read | No - additional task-view permissions required |
| Virtual Machines | Create, discover, update, delete, power on, power off, and reset virtual machines | Create, Read, Update, Delete, Execute | Yes |
| Templates | Create, deploy, update, and remove templates and template versions | Create, Read, Update, Delete, Execute | Yes |
The built-in Virtual Machine Admin role covers most operations used by Parallels RAS. However, it does not include permissions required to retrieve and monitor Prism Central tasks.
Least-Privilege Alternative
Organizations that cannot assign the Super Admin role may create a custom role based on Virtual Machine Admin and add permissions that allow retrieval or viewing of Prism Central tasks.
Based on the Nutanix API documentation, a duplicated Virtual Machine Admin role with task-view permissions added should cover the operations currently used by Parallels RAS.
Important
Custom roles are not currently validated end-to-end by Parallels RAS and are not formally supported. Organizations must thoroughly test custom roles against all Parallels RAS workflows before deploying them in production.
Configuration Comparison
| Configuration | Support Status | Considerations |
|---|---|---|
| Super Admin | Supported | Fully validated end-to-end and least likely to require future permission adjustments. |
| Custom role based on Virtual Machine Admin with task-read permissions | Customer-validated only; not formally supported | Lower privilege model but requires comprehensive testing and ongoing maintenance. |
| Fully custom role | Customer-validated only; not formally supported | Highest maintenance burden. Future Parallels RAS features or Nutanix API changes may require additional permissions. |
Why Task Access Is Required
Many Nutanix operations are asynchronous. When an operation is initiated, Prism Central returns a task identifier rather than an immediate completion result.
Parallels RAS retrieves the task status to determine:
- Whether the operation completed successfully
- Whether the operation failed
- Current progress information
- Relevant error details
Without permission to retrieve or view tasks, Parallels RAS may be unable to confirm the outcome of:
- Virtual machine provisioning
- Cloning operations
- Power management actions
- Template deployment and updates
- Resource deletion
- Other provider-related operations
Validating a Custom Role
If a custom RBAC role is used, validate all applicable workflows before production deployment.
Recommended Test Checklist
- Provider connection and authentication
- Cluster discovery
- Subnet discovery
- Virtual machine discovery
- Template discovery
- Virtual machine provisioning
- Virtual machine cloning
- Power on operations
- Power off operations
- Reset operations
- Template deployment workflows
- Template update workflows
- Virtual machine deletion
- Template deletion
- Asynchronous task completion monitoring
- Error reporting and failure handling
Monitor both Parallels RAS and Nutanix Prism Central logs for authorization failures during testing.
In addition, review and retest custom roles whenever:
- Parallels RAS is upgraded
- Nutanix Prism Central is upgraded
- New Parallels RAS features are introduced
- Nutanix API permissions or behaviors change
This helps ensure that future product changes do not introduce new permission requirements that affect existing workflows.
Support Position
Parallels can provide full support only for deployments using the Nutanix Super Admin role because this is the permission set used during product validation and testing.
Reduced-privilege configurations, including custom roles based on Virtual Machine Admin, may function successfully but are considered customer-managed configurations. Customers remain responsible for validating these roles in their own environments and after future Parallels RAS or Nutanix Prism Central upgrades.
References
- Nutanix API v4.1 - Virtual Machine and Template Operations
- Nutanix API v4.1 - Prism Tasks
- Nutanix API v4.1 - Cluster Management
- Nutanix API v4.1 - Networking
Was this article helpful?
Tell us how we can improve it.