// Module included in the following assemblies:
//
// * authentication/managing_cloud_provider_credentials/cco-mode-passthrough

:_mod-docs-content-type: REFERENCE

[id="cco-passthrough-mode-permissions_{context}"]
= Passthrough mode permissions requirements

[role="_abstract"]
When using the CCO in passthrough mode, ensure that the credential you provide meets the requirements of the cloud on which you are running or installing {product-title}. If the provided credentials the CCO passes to a component that creates a `CredentialsRequest` CR are not sufficient, that component will report an error when it tries to call an API that it does not have permissions for.

Amazon Web Services (AWS) permissions::
The credential you provide for passthrough mode in AWS must have all the requested permissions for all `CredentialsRequest` CRs that are required by the version of {product-title} you are running or installing.
+
To locate the `CredentialsRequest` CRs that are required, see "Manually creating long-term credentials for AWS.

Microsoft Azure permissions::
The credential you provide for passthrough mode in Azure must have all the requested permissions for all `CredentialsRequest` CRs that are required by the version of {product-title} you are running or installing.
+
To locate the `CredentialsRequest` CRs that are required, see "Manually creating long-term credentials for Azure".

{gcp-first} permissions::
The credential you provide for passthrough mode in {gcp-short} must have all the requested permissions for all `CredentialsRequest` CRs that are required by the version of {product-title} you are running or installing.
+
To locate the `CredentialsRequest` CRs that are required, see "Manually creating long-term credentials for {gcp-short}".

{rh-openstack-first} permissions::
To install an {product-title} cluster on {rh-openstack}, the CCO requires a credential with the permissions of a `member` user role.

VMware vSphere permissions::
To install an {product-title} cluster on VMware vSphere, the CCO requires a credential with the following vSphere privileges:

.Required vSphere privileges
[cols="1,2"]
|====
|Category |Privileges

|Datastore
|_Allocate space_

|Folder
|_Create folder_, _Delete folder_

|vSphere Tagging
|All privileges

|Network
|_Assign network_

|Resource
|_Assign virtual machine to resource pool_

|Profile-driven storage
|All privileges

|vApp
|All privileges

|Virtual machine
|All privileges

|====

If `CredentialsRequest` CRs change over time as the cluster is upgraded, you must manually update the passthrough mode credential to meet the requirements. To avoid credentials issues during an upgrade, check the `CredentialsRequest` CRs in the release image for the new version of {product-title} before upgrading.

To locate the `CredentialsRequest` CRs that are required for {aws-short}, {azure-short}, or {gcp-short}, see the _Manually creating long-term credentials_ topic for your platform.
