---
title: Permissions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Cloud Cost Management > Setup > Permissions
---

# Permissions

## Overview{% #overview %}

Permissions control what actions a user can take in Datadog. Users are assigned to roles, and each role has a set of permissions that determines what that user can see and do.

Cloud Cost Management (CCM) uses two main permissions, `cloud_cost_management_read` and `cloud_cost_management_write`, to control access to cost data and most CCM configurations. Additional product-level permissions are available for specific features, such as editing budgets (`ccm_budget_write`) and managing report schedules (`generate_ccm_report_schedules`, `manage_ccm_report_schedules`). Assign these permissions to roles through [Role Based Access Control (RBAC)](https://docs.datadoghq.com/account_management/rbac.md).

CCM also supports Data Access Control to further restrict cost data by tags.

## Available permissions{% #available-permissions %}

| Permission                      | Description                                                                                                                                                                                 |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `cloud_cost_management_read`    | Grants read-only access to view cost data, budgets, recommendations, and settings across CCM pages and external integrations.                                                               |
| `cloud_cost_management_write`   | Grants access to modify CCM configurations, including uploading custom costs and managing cloud accounts. Does not grant access to create, edit, or delete budgets; see `ccm_budget_write`. |
| `ccm_budget_write`              | Grants access to create, update, and delete Cloud Cost Management budgets, including budget metadata and budgeted amounts per entry. Requires the read permission to access pages.          |
| `generate_ccm_report_schedules` | Grants access to view all report schedules and manage only the ones the user has created.                                                                                                   |
| `manage_ccm_report_schedules`   | Grants access to view, create, and fully manage all report schedules across the organization.                                                                                               |

## Permission requirements by page{% #permission-requirements-by-page %}

The table below shows the required permissions for each CCM page and related features.

| Page/Functionality                            | Read Permission                                 | Write Permission                                               |
| --------------------------------------------- | ----------------------------------------------- | -------------------------------------------------------------- |
| CCM Summary Page                              | Required to view cost summary data              | N/A                                                            |
| CCM Containers Page                           | Required to view container cost allocation data | N/A                                                            |
| CCM Recommendations Page                      | Required to view cost recommendations           | N/A                                                            |
| CCM Explorer Page                             | Required to query and view cost data            | N/A                                                            |
| CCM Plan Page                                 | Required to view budgets                        | `ccm_budget_write` required to create, edit, or delete budgets |
| CCM Settings Page - Custom Costs              | Required to view custom costs settings          | Required to upload custom costs                                |
| CCM Settings Page - Tag Pipelines             | Required to view tag pipelines                  | Required to create tag pipelines                               |
| CCM Settings Page - SaaS Integrations         | Required to view SaaS integration settings      | Required to enable integration for CCM                         |
| CCM Settings Page - Accounts                  | Required to view cloud accounts                 | Required to modify or create accounts                          |
| CCM Settings Page - Configure Recommendations | Required to view recommendation settings        | Required to customize recommendations                          |
| Dashboards/Notebooks (external)               | Required to create widgets and view cost data   | N/A                                                            |
| Monitors (external)                           | Required to create CCM monitors                 | N/A                                                            |
| Service Catalog (external)                    | Required to view cost data                      | N/A                                                            |
| Resource Catalog (external)                   | Required to view cost data                      | N/A                                                            |
| API Queries for Cost Data                     | Required to query cost data through the API     | N/A                                                            |

## Data access control{% #data-access-control %}

Use [Data Access Control](https://docs.datadoghq.com/account_management/rbac/data_access.md) to restrict access to cost data by specific tags. With this feature, you can limit teams to see only costs relevant to their resources. For example, restricting a team to view only costs tagged with `team:payments` or `env:production`.

## Further reading{% #further-reading %}

- [Learn about Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management.md)
- [Learn about Role Based Access Control](https://docs.datadoghq.com/account_management/rbac.md)
- [Learn about Data Access Control](https://docs.datadoghq.com/account_management/rbac/data_access.md)