To initially view and manage User Access on Red Hat Hybrid Cloud Console, you must be an Organization Administrator. This is because User Access requires user management capabilities that are designated from the Red Hat Customer Portal at Customer Portal. Those capabilities belong solely to the Organization Administrator.

The User Access administrator role is a special role that the Organization Administrator can assign. This role allows users who are not Organization Administrator users to manage User Access on Red Hat Hybrid Cloud Console.

User access on Red Hat Hybrid Cloud Console uses an additive model, which means that there are no deny roles. In other words, actions are only permitted. To control access, assign the appropriate roles with the desired permissions to groups, then add users to those groups. The access permitted to any individual user is a sum of all roles assigned to all groups to which that user belongs.

User Access uses the following categories to determine the level of user access that an Organization Administrator can grant to the supported Red Hat Hybrid Cloud Console services. The access provided to any authorized user depends on the group that the user belongs to and the roles assigned to that group.

An Organization Administrator adds or deletes roles and users to groups. The group can be a new group created by an Organization Administrator or the group can be an existing group. By creating a group that has one or more specific roles and then adding users to that group, you control how that group and its members interact with the Red Hat Hybrid Cloud Console services.

When you add users to a group, they become members of that group. A group member inherits the roles of all other groups they belong to. The user interface lists users in the Members tab.

The Add a cloud source wizard steps you through creating a source. You can add Amazon Web Services (AWS), Google Cloud, and Microsoft Azure. The wizard provides detailed information for each public cloud provider.

You have two choices for the configuration mode:

If you select Account authorization, you provide your AWS account credentials (Access key ID and Secret key ID) and Red Hat configures and manages your source for you. This option automatically selects the Cost Management and the RHEL management bundle applications. You can deselect these applications.

If you select Manual configuration, you choose Cost Management, RHEL management bundle, or No application.

The Cost Management application allows you to perform financially related tasks, such as:

The RHEL management bundle includes the following items:

The Cost Management and the RHEL management bundle applications require you to enable account access. You accomplish this by creating an IAM policy, an IAM role, and entering your Amazon Resource Name (ARN). An ARN is a generic name for an Amazon resource and has a common format depending on the service involved. In this case, it is the identity and access management (IAM) service and Role resource-type.

If you select No application, you choose which credentials to supply:

Cost Management is the only application choice. You must create an IAM role and assign access.

The Cost Management application allows you to perform financially related tasks, such as:

If you select No application, you provide the Project ID and the Service Account JSON as credentials.

Application choices include Cost Management, RHEL management bundle, or No application.

The Cost Management application allows you to perform financially related tasks, such as:

The RHEL management bundle includes the following items:

You create a dedicated resource group and a storage account in the Azure Portal so you can collect cost data and metrics for cost management. You then use your subscription ID to create a Cost Management Storage Account Contributor role in the Cloud Shell. Using the subscription ID to run a second command in the Cloud Shell gives you the tenant (directory) ID, client (application) ID, and client secret necessary to complete setting up that role.

The workflow for adding Red Hat OpenShift Container Platform as a cloud source includes the following high-level steps:

Cost Management is the only application choice. The Cost Management application allows you to perform financially related tasks, such as:

Getting started with cost management

Getting Started with the Subscriptions Service

Adding sources for public cloud metering

Getting started with Automation Services Catalog

Bucket restrictions and limitations

Bucket naming rules

As Linux becomes the mandatory operating system for SAP ERP workloads in 2025, Red Hat Enterprise Linux and Red Hat Hybrid Cloud Console are working to make Hybrid Cloud Console the management tool of choice for SAP administrators.

As part of this ongoing effort, Hybrid Cloud Console automatically tags systems running SAP workloads and by SAP ID (SID), without any customization needed by administrators. Users can easily filter those workloads throughout the Hybrid Cloud Console application by using the global Filter by tags drop-down menu.

Satellite host groups are configured in Satellite and recognized automatically by Hybrid Cloud Console.

Red Hat Hybrid Cloud Console users can use the global Filter by tags feature to select groups of systems running Microsoft SQL Server workloads.

In May of 2019, the Red Hat Insights team introduced a new set of Hybrid Cloud Console recommendations for Microsoft SQL Server running on Red Hat Enterprise Linux (RHEL). These rules alert administrators to operating system level configurations that do not conform to the documented recommendations from Microsoft and Red Hat.

A limitation of these rules was that they primarily analyzed the operating system, and not the database itself. The latest release of Hybrid Cloud Console and RHEL 8.5 introduces Microsoft SQL Assessment API. The SQL Assessment API provides a mechanism to evaluate the database configuration of MS SQL Server for best practices. The API is delivered with a rule set that contains best practice rules that have been suggested by the Microsoft SQL Server Team. While this rule set is enhanced with the release of new versions, the API is built with the intent to give a highly customizable and extensible solution. This enables users to tune the default rules and to create their own.

The SQL Assessment API is supported by PowerShell for Linux (available from Microsoft), and Microsoft has developed a PowerShell script that can be used to call the API and store its results as a JSON formatted file. With RHEL 8.5, the Insights client now uploads this JSON file and presents the results in an easy-to-understand format in the Hybrid Cloud Console UI.

For more information about SQL Server assessment in Hybrid Cloud Console, see SQL Server database best practices now available through Red Hat Insights.

By applying custom grouping and tagging to your systems, you can add contextual markers to individual systems, filter by those tags in the Hybrid Cloud Console application, and more easily focus on related systems. This functionality can be especially valuable when deploying Hybrid Cloud Console at scale, with many hundreds or thousands of systems under management.

In addition to the ability to add custom tags to several Hybrid Cloud Console services, you can add predefined tags. The advisor service can use those tags to create targeted recommendations for your systems that might require more attention, such as those systems that require a higher level of security.

# tags
---
group: eastern-sap
name: Jane Example
contact: jexample@corporate.com
Zone: eastern time zone
Location:
- gray_rack
- basement
Application: SAP

3.4.5. Configuring predefined tags

You can use the Red Hat Hybrid Cloud Console advisor service’s predefined tags to adjust the behavior of recommendations for your systems. This enables your systems to gain extended security hardening and enhanced detection and remediation capabilities. This section describes how to configure the predefined tags.

Prerequisites

• You have root-level access to your system
• You have Insights client installed
• You have systems registered within the Insights client
• You have already created the tags.yaml file. See Creating a tags.yaml file and adding a custom group

Procedure

• At the command line, use your preferred editor to open the tags.yaml configuration file located in /etc/insights-client/. (The following example uses Vim.)

  [root@server ~]# vi /etc/insights-client/tags.yaml

• Edit the /etc/insights-client/tags.yaml file to add the predefined key=value pair for the tags. This example shows how to add security: strict and network_performance: latency tags.

  # cat /etc/insights-client/tags.yaml
  group: redhat
  location: Brisbane/Australia
  description:
  - RHEL8
  - SAP
  security: strict
  network_performance: latency

• Save your changes.
• Close the editor.

• Optional: Run the insights-client command to generate an upload to Red Hat Hybrid Cloud Console, or wait until the next scheduled Red Hat Insights upload.

  [root@server ~]# insights-client

Confirming that predefined tags are in your production area

After generating an upload to Red Hat Insights (or waiting for the next scheduled Insights upload), you can check whether the tags are in the production environment by accessing Red Hat Enterprise Linux > Inventory. Find your system and look for the new tags. You should see something similar to what is shown in the following image.

Example of recommendations after applying a predefined tag

In the following image, the advisor service shows a system with the network_performance: latency tag configured.

The system shows a recommendation with a higher Total Risk that is categorized as Important. The system without the network_performance: latency tag is categorized with a Total Risk of Moderate. You can make decisions about prioritizing the system with the higher Total Risk.

The inventory reporting service, as part of its messaging, includes a timestamp for when the report about the host is considered stale. This timestamp is determined by the reporting service and defaults to a value set by the user account.

When various reporters contribute data to the host in the host inventory, staleness states are recalculated.

Systems in the inventory have the following three fields related to staleness and deletion:

Rules:

You can see stale systems and the ones scheduled for deletion in the following places in the Red Hat Insights user interface:

Dashboard: In the Red Hat Insights dashboard summary, you can see the number of stale systems and the number of systems scheduled for deletion displayed under System inventory. Click on the respective links to see the list of stale systems and the ones marked for deletion.

Inventory: On the last seen column, you will see systems marked for deletion with a warning icon. Hover on the last seen information to see if a system will be removed from the inventory in the next x days or if it is already scheduled for deletion.

You can filter the inventory by system status: Fresh, Stale, and Stale warning. Note that by default fresh and stale systems are listed, but stale warning systems are not shown in the user interface. You can also select the source, which is Insights by default, and filter by system name. You can remove a particular filter in effect, or clear all at once.