vCenter Endpoints - Account Setup and Permissions


To improve security and stability of an environment, an account with minimal privileges should be used to integrate CloudBolt with other systems.

VMware vCenter Endpoint Credentials

Applies to Provisioning, Snapshots, VM Tagging and connections using VMware Tools

It is useful to create a separate service account to make it easier to attribute vCenter activity to these integration points.

Note: Using an vCenter Admin account for the CloudBolt integration is also acceptable from a functionality stand-point.

Privileges Required

The privileges required for each integration are as follows, to use these with a service account it is necessary to create a custom role.

If the intention is to restrict access to a specific subset of virtual machines managed in vCenter, take note of the Applies to column in the below table as this indicates where the privileges need to take effect in the vCenter hierarchy

CloudBolt IntegrationPrivilegePrivilegeIdApplies to


Host > Inventory > Modify Cluster

Datastore > Allocate Space

Datastore > Browse Datastore

Network > Assign Network (if the target virtual machine has network adapters)

Resource > Assign Virtual Machine To Resource Pool

Virtual Machine > Inventory

Virtual Machine > Configuration

Virtual Machine > Interaction > Power On (if the target virtual machine is to be powered on after conversion)

Virtual Machine > Provisioning > Allow Disk Access

Virtual Machine > Provisioning > Allow Read-Only Disk Access

Host > Local operations > Create virtual machine

Host > Local operations > Delete virtual machine

Host > Local operations > Reconfigure virtual machine


Virtual machine > Snapshot management > Create snapshot

VirtualMachine.State.CreateSnapshotVirtual Machines
Virtual machine > Snapshot management > Remove snapshotVirtualMachine.State.RemoveSnapshotVirtual Machines
Virtual machine > Snapshot management > Rename snapshotVirtualMachine.State.RenameSnapshotVirtual Machines
Virtual machine > Snapshot management > Revert to snapshotVirtualMachine.State.RevertToSnapshotVirtual Machines
VM Tagging

vSphere Tagging > Assign or Unassign vSphere Tag

vSphere Tagging > Create vSphere TagInventoryService.Tagging.CreateTag
vSphere Tagging > Create vSphere Tag CategoryInventoryService.Tagging.CreateCategory
VMware Tools
Connection Type

Virtual machine > Guest Operations > Guest Operation QueriesVirtualMachine.GuestOperations.QueryVirtual Machines
Virtual machine > Guest Operations > Guest Operation Program ExecutionVirtualMachine.GuestOperations.ExecuteVirtual Machines
Virtual machine > Guest Operations > Guest Operation ModificationsVirtualMachine.GuestOperations.ModifyVirtual Machines

Have more questions? Submit a request


Please sign in to leave a comment.