# Ensure Public Cloud Users Do Not Hold the Administrator Role Unnecessarily

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826035473676-ensure-public-cloud-users-do-not-hold-the-administrator-role-unnecessarily
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Public Cloud project users (OpenStack users) are given only the roles they need, such as Compute Operator or ObjectStore operator, and that the Administrator role is limited to users who truly need full control of the project.

**Rationale**

A Public Cloud user with the Administrator role can create, change, or delete every resource in the project through the API or Horizon. These credentials are often used in scripts and tools, so a leak gives an attacker full control of the project. Narrow roles limit the damage.

**Impact**

-   Limits damage from leaked OpenStack credentials
    
-   Enforces least privilege in the project
    
-   Tools may need users with different roles
    

**Default Value**

When creating a Public Cloud user, you choose its roles, and the Administrator role can be selected.

**Pre-Requisites**

-   Permission to manage the Public Cloud project
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, under Settings, select Users & Roles.
    
4.  Review the roles of each user and flag users with the Administrator role.
    
5.  If a user has the Administrator role without a documented need, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In Users & Roles, click the ⋯ button next to the user and select Edit roles.
    
4.  Untick Administrator, tick only the roles the user needs (for example Compute Operator or ObjectStore operator), and click Confirm.
    
5.  Confirm that the tools using this user still work.
    

**Backout Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In Users & Roles, click the ⋯ button next to the user, select Edit roles, tick Administrator again, and click Confirm.
    

**Reference**

-   [https://help.ovhcloud.com/csm/en-public-cloud-compute-openstack-users?id=kb\_article\_view&sysparm\_article=KB0050625](https://help.ovhcloud.com/csm/en-public-cloud-compute-openstack-users?id=kb_article_view&sysparm_article=KB0050625)
    
-   [https://docs.ovhcloud.com/en/guides/public-cloud/ai-machine-learning/ai-users](https://docs.ovhcloud.com/en/guides/public-cloud/ai-machine-learning/ai-users)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.