What specific permissions are required to allow users to delete nodes from the "Client Runs" in Chef Automate?

How to delete the missing nodes from Infrastructure client runs only in Chef Automate ?

Can we create a custom "Admin" role that allows users to manage nodes, environments, and operational settings—without granting full automation capabilities or access to high-risk system configurations in Chef Automate?

This role is intended for manual administrative actions, specifically for the deletion of missing nodes in Chef Automate. While the Data Lifecycle feature can be used to manage missing nodes automatically, this article defines the role which is designed to support manual intervention with granular access controls.

This article outlines the specific IAM (Identity and Access Management) actions required to delete missing nodes manually from client runs in Chef Automate. These actions are defined with a granular approach to ensure that access is tightly scoped and adheres to the principle of least privilege.

The focus is primarily on the permissions necessary to perform deletion operations, ensuring that users or roles are only granted access to the exact actions they need—nothing more. This minimizes the security risk while allowing for efficient management of stale or inactive client nodes.

By clearly specifying each required permission, this documentation supports secure operational practices and helps administrators configure IAM policies confidently and accurately.

Managing Missing Nodes

Configure the timing for marking nodes as missing and subsequently deleting them through the Data Lifecycle section on the Settings tab in Chef Automate https://docs.chef.io/automate/data_lifecycle/

Deleting Missing Nodes

Admins and users with the appropriate permissions, as defined in access policies, can delete only missing nodes from the Chef Infra Client Runs page. Active nodes cannot be deleted.

Create a custom role - https://docs.chef.io/automate/roles/#custom-roles

Custom roles can only be created using the Roles API.

Creating a role named - "My Deletion Role" with the below list of actions defined for the Custom role in Chef Automate.

{
  "actions": [
    "ingest:*"
  ],
  "id": "delete-role",
  "name": "My Deletion Role"
}

Create a custom policy - "Onlydeletion-policy" with the role created.

{
  "id": "Onlydeletion-policy",
  "members": [
    "*"
  ],
  "name": "view",
  "projects": [],
  "statements": [
    {
      "effect": "ALLOW",
      "projects": [
        "*"
      ],
      "role": "delete-role"
    }
  ]
}

Assign the policy - 

Assign the appropriate policy to the intended user, this can be either a local user or a member of a team. Ensure the policy is correctly attached to the user or team role, depending on your organization's access management model.

Validate the Access - 

After assigning the policy, validate that the user has the correct permissions associated with it, specifically the ability to delete missing nodes. 

This ensures that the policy is functioning as intended and that the user has the necessary but limited access to perform manual deletions within the defined scope.

References -

Data Life Cycle - https://docs.chef.io/automate/data_lifecycle/

Client Runs - https://docs.chef.io/automate/client_runs/