Anyscale for admins

This page provides an overview of the Anyscale platform for admins.

Who are Anyscale admins?

The user who first creates your Anyscale organization is the organization owner and admin. Organization owners can add additional admins by assigning them the organization owner role. Most admin tasks require the organization owner role in Anyscale. See Organization owner.

Anyscale recommends following the principle of least privilege when configuring Anyscale roles. Organization owners inherit full privileges on all objects in Anyscale.

Many tasks require elevated privileges in the cloud provider account or Kubernetes cluster where you deploy your Anyscale cloud. Some tasks require configuring compute configs or building custom images to fully integrate Anyscale clusters with infrastructure in your cloud provider account. See Define a Ray cluster.

The following are examples of users that might need admin permissions on Anyscale:

• Systems integrators
• DevOps and MLOps
• Cloud admins
• Data stewards

note

All collaborators in an Anyscale cloud can create projects in that cloud deployment. When you create a project, you're the project owner and can set permissions for other users on your project. See Project owner.

Where should you get started as an admin?

If your organization is brand new to Anyscale, see the following articles:

• Get started for admins
• Anyscale architecture
• Shared responsibility model

The following table helps you navigate to product documentation aligned to common admin tasks and topics:

Topic	Product docs
Cloud deployment	You configure and deploy Anyscale clouds to allow Anyscale to manage Ray clusters in your cloud provider account or Kubernetes cluster. For an overview, see Introduction to Anyscale clouds. See the following pages for more details on deploying clouds: Deploy an Anyscale cloud on AWS Deploy an Anyscale cloud on GCP Deploy Anyscale on Kubernetes
Managing compute	Developers manage many cluster configuration tasks on Anyscale, but admins might need to help configure permissions and IAM roles for compute configs and custom images. Admins can also do the following: Specify resource quotas to control the number and type of instances that users can deploy. Configure machine pools to use capacity reservations from your cloud provider account with Anyscale.
Cloud IAM	Anyscale uses IAM roles in your cloud provider account to deploy infrastructure on your behalf and control access to resources in your cloud ecosystem. You configure additional IAM roles and permissions to customize permissions and grant access to cloud infrastructure. You configure IAM roles for use by the Anyscale control plane and your customer data plane during cloud deployment. Use cloud IAM mapping to configure permissions for Ray clusters in your cloud account based on workload type, project, or user identity. See Anyscale Cloud IAM mapping (Developer Preview). You configure a default storage location during cloud deployment, but you can configure access to any cloud object storage location by adding permissions to the role attached to your Anyscale cluster. See Private storage buckets. Add IAM permissions to allow Anyscale to access secret managers in your cloud provider account. See Secret management on Anyscale. Configure IAM access to artifact registries such as ECR or Google Artifact Registry to use custom images. See Use container images from an external registry.
User management	You manage user permissions at the organization, cloud, or project level. See Anyscale organization overview. Anyscale recommends configuring SSO for all organizations. Use access controls to control user permissions. Add or delete users from your organization. You can configure your Anyscale organization to automatically add users as collaborators when you deploy an Anyscale cloud. Create and manage service accounts for automations and integrated services that require authentication to Anyscale.
Observability and monitoring	Anyscale provides admins with logs, dashboards, and alerts to help monitor access and resource utilization. Admins might also use the same monitoring tools available to developers to get a more granular view of compute resources. See Monitor and debug Anyscale workloads. Audit logs capture user events across the console, CLI, and SDK. Use dashboards to get an overview of resource use. Configure resource notifications to get alerts on certain events, such as when a service becomes unhealthy or a job succeeds or fails.
Usage and billing	You can control usage using resource quotas, user roles, and cloud IAM mapping. View the usage dashboard to see an overview of Anyscale use over time and drill down into usage by workload, project, or user. Use budgets to configure expected spend for an organization, cloud, or project and receive alerts if workloads exceed the budget.