...
The menu down the left side is grouped:
| Group | Entries |
|---|---|
| Workspace | Dashboard · My Usage · Projects · Cost & Budget |
| Administration | Create Project · FinOps · Users |
| Operations | Health Checks · Audit Events · Keycloak Sync · Spawn Events · Application Logs |
Some of those entries belong to the platform team, not to you. Create Project is one of them. What you can open depends on your role.
Open Projects, then your project, and you get everything below on one page.
...
A project's page: the IAM role panel, provisioning, integrity, collaboration, and the members list. Member names are blurred.
What you can do yourself
Manage your team
...
- Add member — put an existing platform user on your project.
- Create user — bring in someone who is not on the platform yet.
- The gear beside each member opens that member's settings.
...
Add member: pick the user from the list. Names are blurred.
...
The gear menu on a member: Set Budget, Revoke Project Admin, Set ARN Role, Remove.
A member must already have a NASA identity or a STAR ID. See How to get access.
...
You set a budget per member. Think of it as a spending limit for that person, cut out of the project's money. The console stops you from handing out more than the project holds.
...
Set budget: the dialog tells you how much is still available for this member.
| Info |
|---|
Today the limit is a warning, not a wall. A member who reaches their limit can still launch a workspace. Watch the numbers, and talk to the person. Coming: you will choose what happens when a member passes their limit — block them from launching, or let them keep working and spend from the project's pool. |
...
The Real-Time Collaboration panel has one button: Enable collaboration.
...
The Real-Time Collaboration panel, before collaboration is enabled.
The console explains what it does: enabling it creates a shared, login-less <project>-collab account. Members co-edit in that shared workspace, with no impersonation — nobody works as anybody else. Compute and storage charge the project pool.
...
- The role name must start with
ResearchPlatform-Workloadrp-nb-target-project-. - Its trust policy must allow the Research Platform to assume it. (A trust policy says who is allowed to use the role.)
Paste the ARN and press Save Role ARN. Leave the box empty to use the project or group default.
...
The Project Default IAM Role ARN panel, with the two rules under the box.
The role you set here applies to every member. A single member can be given a different role in the Members panel.
The console itself carries a the instructions: the "See how to create your project role" link opens a help page inside RPAdmin with the steps for your AWS administrator. If anything is unclear, write to support@sciencecloud.nasa.gov.
...
Audit Events records every change to accounts, memberships, and budgets, with who did it and what changed. You see your own project's history.
...
The Audit Events list: when, what action, what it touched, and who did it. Names are blurred.
What only the platform team can do
| Action | Why |
|---|---|
| Create a project | A new project needs approval by Science Cloud finance and management first |
| Set the project's total budget | The number is entered after the Science Cloud receives the funds |
| Platform-wide operations | Keycloak Sync, Spawn Events, Application Logs, fleet health |
So the money works in two steps:
...