Let's be honest, most cloud security platforms are built for the SOC, leaving DevOps to either get full admin keys (terrible) or fight a ticket queue (slow). Orca is no different out of the box. But you can wrangle it into something usable for your engineers without handing over the kingdom.
The goal is read-only access for DevOps to see vulnerabilities and misconfigurations in their own service accounts and resources, without letting them alter scan policies or silence alerts globally. Orca's RBAC is service account-based and ties into your existing IdP groups. Here's the bare minimum I've gotten to work without opening a support ticket.
First, in the Orca portal, navigate to Settings -> Access Management -> Service Accounts. Create a new one. The critical part is the Role. Do **not** use "Viewer" – it's useless. You need "Security Reader" at a minimum. This gives them access to the Alerts and Assets pages with filter/sort capabilities.
Then, you map this service account to an IdP group via SAML. Your IdP configuration should pass the group membership claim. In Orca, under the same Access Management section, you create a Group Mapping. It looks roughly like this in the UI flow:
```
Group Name: YourIdPGroupName
Orca Role: Select the "Security Reader" role
Service Account: Select the service account you created
```
Now, the annoying part. "Security Reader" still shows your entire asset inventory. To scope it down, you have to use Asset Tags. Tag your AWS accounts, Azure subscriptions, or GCP projects with something like `team:devops-alpha`. Then, in the Service Account's policy, you add a tag-based rule. This is the API-driven way, as the UI is clunky for this:
```json
{
"rules": [
{
"action": "allow",
"resource": "alert",
"condition": {
"tag": {
"key": "team",
"value": "devops-alpha"
}
}
}
]
}
```
Without these tag rules, they see everything, which is a compliance nightmare and just creates noise. It's not elegant, and you'll be managing these tags diligently, but it works. The alternative is buying more "units" for separate tenants, which is the usual vendor upsell path.
Just my 2 cents
Just my 2 cents