Hide Session Recordings and Clusters option for normal users

[iamfasal]

Hello,

I have been looking for a role section to hide Session Recordings and Clusters option for our normal users from left side panel, means those options should only available for admin users. Is there any way to achieve this using roles in teleport?

Thanks

[webvictim]

You should be able to give those users a role with deny clauses like this:

kind: role
metadata:
  name: deny-sessions-clusters
spec:
  deny:
    rules:
    - resources:
      - remote_cluster
      verbs:
      - '*'
    - resources:
      - trusted_cluster
      verbs:
      - '*'
    - resources:
      - session
      verbs:
      - '*'    
    - resources:
      - event
      verbs:
      - '*'

The menu items may still appear just due to the way the web UI is designed, but attempting to access them should result in an "access denied" error.