How to provide access to user to list roles and infrastructure data from Chef Automate server?

Define a custom role for using the API with minimal permissions to list Chef Infra Server?

These are listed for specific usage for listing roles and infrastructure data from Chef Automate server.

In Chef Automate, roles and policies help define access control and permissions for users. Chef Automate uses roles to define permissions across the platform (UI and API).

Roles – In Chef Automate, roles are collections of actions that define what activities a user can perform. These roles are used to build policies and are a core part of the Identity and Access Management (IAM) system. They determine the permissions available to users within Automate.

Policies – IAM policies in Chef Automate control which actions users or teams (identities) can perform and on which resources. Policies are made up of one or more statements, with each statement granting specific permissions tied to roles.

The following section explains how to create a custom role and policy, and how to assign them to users or teams.

Create a custom role - https://docs.chef.io/automate/roles/#custom-roles

Custom roles can only be created using the Roles API.

Creating a role named - "My Super Reader Role" with the below list of actions defined for the Custom role in Chef Automate.

  "actions": [
    "infra:infraServers:list",
    "infra:infraServers:get",
    "infra:nodes:get",
    "infra:nodes:list",
    "infra:nodeManagers:get",
    "infra:nodeManagers:list",
    "iam:projects:list",
    "iam:projects:get",
    "iam:roles:list"
  ],
  "id": "reader-role",
  "name": "My Super Reader Role"
}

Create a custom policy - "minimalreader-policy" with the role created.

{
  "id": "minimalreader-policy",
  "members": [
    "*"
  ],
  "name": "view",
  "projects": [],
  "statements": [
    {
      "effect": "ALLOW",
      "projects": [
        "*"
      ],
      "role": "reader-role"
    }
  ]
}

Create token with the attached policy – "Minimal Reader"

Validate the access which will list the roles using the token. By this it will list the required roles.

References: 

Policies - https://docs.chef.io/automate/policies/

Roles - https://docs.chef.io/automate/roles/

API Tokens - https://docs.chef.io/automate/api_tokens/