Define a Custom Role in vSphere for the NSX Service Accounts for Identity and Access Management for VMware Cloud Foundation

To limit the privileges and scope for the NSX integration with vSphere, you create a custom role in vSphere with the required privileges.

UI Procedure

Log in to vCenter Server at https://<vcenter_server_fqdn>/ui as administrator@vsphere.local.
From the vSphere Client menu, select Administration.
In the Access control section, click Roles.
From the Roles provider drop-down menu, select vsphere.local.

Create a role for NSX in vSphere.

For VMware Cloud Foundation 4.4, click New, in the New role dialog box, configure the privileges, and click Create.

For VMware Cloud Foundation 4.3.1 or earlier, click the Create role action button, configure the privileges, and click Next.


Category	Privilege
Extension	All Extension Privileges
Global	Cancel task
Global	Licenses
Host	Configuration.Maintenance
	Configuration.Network configuration
	Local operations.Create virtual machine
	Local operations.Delete virtual machine
Network	Assign network
Permissions	Modify permission
	Modify role
	Reassign role permissions
Resource	Assign vApp to resource pool
Resource	Assign virtual machine to resource pool
Scheduled task	All Scheduled task Privileges
Service account management	Administer
Sessions	Message
	Validate session
	View and stop sessions
Tasks	All Tasks Privileges
VMware vSphere Lifecycle Manager	Lifecycle Manager: General Privileges.Read
	Lifecycle Manager: General Privileges.Write
	Lifecycle Manager: Image Privileges.Read
	Lifecycle Manager: Image Privileges.Write
	Lifecycle Manager: Image Remediation Privileges.Write
	Lifecycle Manager: Settings Privileges.Read
	Lifecycle Manager: Settings Privileges.Write
Virtual machine	Change Configuration
	Edit Inventory
	Guest Operations
	Provisioning
vApp	All vApp Privileges

In the Role name text box, enter a name for the NSX to vSphere integration role, and click Finish.

PowerShell Procedure

Start PowerShell.

Replace the values in the sample code with values from your VMware Cloud Foundation Planning and Preparation Workbook and run the commands in the PowerShell console.

$sddcManagerFqdn = "sfo-vcf01.sfo.rainpole.io"
$sddcManagerUser = "administrator@vsphere.local"
$sddcManagerPass = "VMw@re1!"

$sddcDomainName = "sfo-m01"

$vsphereRoleName = "NSX to vSphere Integration"

Define a custom role in vSphere for the NSX service accounts.
1. Perform the configuration by running the command in the PowerShell console.
```
Add-vSphereRole -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -sddcDomain $sddcDomainName -roleName $vsphereRoleName
```
2. In the dialog box that opens, navigate to the vSphereRoles folder and open the nsx-vsphere-integration.role file.
  The default path for the vSphereRoles folder is C:\Program Files\WindowsPowerShell\Modules\PowerValidatedSolutions\<powervalidatedsolutions_version>\vSphereRoles.