// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-getting-started-deploying/cloud-experts-getting-started-detailed-ui.adoc

:_mod-docs-content-type: PROCEDURE

[id="cloud-experts-getting-started-detailed-ui-associate-associate-roles_{context}"]
= Creating and associating an {cluster-manager} role

[role="_abstract"]
Create and associate an {cluster-manager} role to enable cluster management through the {cluster-manager} {hybrid-console-second}.

.Procedure
. Run the following command to see if an {cluster-manager} role exists:
+
[source,terminal]
----
$ rosa list ocm-role
----

. The UI displays the commands to create an {cluster-manager} role with two different levels of permissions:
+
* *Basic {cluster-manager} role:* Allows the {cluster-manager} to have read-only access to the account to check if the roles and policies that are required by {product-title} are present before creating a cluster. You will need to manually create the required roles, policies, and OIDC provider using the CLI.
* *Admin {cluster-manager} role:* Grants the {cluster-manager} additional permissions to create the required roles, policies, and OIDC provider for {product-title}. Using this makes the deployment of a {product-title} cluster quicker since the {cluster-manager} will be able to create the required resources for you.
+
To read more about these roles, see the "{cluster-manager} roles and permissions" documentation in the _Additional resources_.
+
For the purposes of this tutorial, use the *Admin {cluster-manager} role* for the simplest and quickest approach.

. Copy the command to create the Admin {cluster-manager} role from the sidebar or switch to your terminal and enter the following command:
+
[source,terminal]
----
$ rosa create ocm-role --mode auto --admin --yes
----
+
This command creates the {cluster-manager} role and associates it with your Red{nbsp}Hat account.
+
**Example output**
+
[source,terminal]
----
I: Creating ocm role
I: Creating role using 'arn:aws:iam::000000000000:user/rosa-user'
I: Created role 'ManagedOpenShift-OCM-Role-12561000' with ARN 'arn:aws:iam::000000000000:role/ManagedOpenShift-OCM-Role-12561000'
I: Linking OCM role
I: Successfully linked role-arn 'arn:aws:iam::000000000000:role/ManagedOpenShift-OCM-Role-12561000' with organization account '1MpZfntsZeUdjWHg7XRgP000000'
----

. Click *Step 2: User role*.