User Management

This guide covers creating users, managing groups, and assigning permissions in the Serverless CMS.

The CMS uses a group-based permission system with two types of groups:

Platform-level groups with fixed permissions:

Site-scoped groups auto-created for each site:

Example: For a site with subdomain blog, the groups are:

• blog-admin
• blog-author
• blog-templates
• blog-publish

Administrators can create custom groups with specific permissions for specialized workflows.

To create a new user:

1. Navigate to Users from the main navigation
2. Click Create User
3. Fill in the user details:
   • Email: User's email address (used for login)
   • Temporary Password: Initial password (user must change on first login)
   • Groups: Select groups to assign

1. Click Create

The system:

1. Creates the user account in AWS Cognito
2. Sends an invitation email with login instructions
3. Assigns the user to selected groups
4. Requires password change on first login

• Email must be unique across all users
• Temporary password must meet password policy requirements:
  • Minimum 12 characters
  • At least one uppercase letter
  • At least one number
  • At least one symbol

To view a user's group memberships:

1. Navigate to Users
2. Click on a user
3. View the Groups section

To add a user to a group:

1. Navigate to Groups
2. Select the group
3. Click Add Members
4. Select users to add
5. Click Add

To remove a user from a group:

1. Navigate to Groups
2. Select the group
3. Click the × next to the user you want to remove
4. Confirm the removal

To give a user access to a site:

1. Navigate to Sites → Select the site → Groups
2. Select the appropriate site group (admin, author, templates, or publish)
3. Click Add Members
4. Select the user
5. Click Add

To revoke a user's access to a site:

1. Navigate to Sites → Select the site → Groups
2. Select the site group
3. Click the × next to the user
4. Confirm the removal

• Principle of least privilege: Grant only the permissions users need
• Use site groups: Assign users to site groups rather than system groups when possible
• Regular audits: Review user access quarterly
• Remove access promptly: Revoke access when users leave the team

To deactivate a user:

1. Navigate to Users
2. Click the ⋮ menu next to the user
3. Select Deactivate
4. Confirm the action

Deactivated users:

• Cannot log in
• Retain their group memberships (restored if reactivated)
• Remain in the user list (marked as "Inactive")

To reactivate a deactivated user:

1. Navigate to Users
2. Filter by Inactive users
3. Click the ⋮ menu next to the user
4. Select Reactivate
5. Confirm the action

To reset a user's password:

1. Navigate to Users
2. Click the ⋮ menu next to the user
3. Select Reset Password
4. Enter a new temporary password
5. Click Reset

The user will receive an email with instructions and must change the password on next login.

Users can reset their own passwords:

1. On the login screen, click Forgot Password?
2. Enter email address
3. Check email for reset code
4. Enter reset code and new password
5. Log in with new password

Administrators can create custom groups for specialized workflows.

1. Navigate to Groups
2. Click Create Custom Group
3. Fill in the group details:
   • Name: Descriptive group name
   • Description: Purpose of the group
   • Permissions: Select permissions to grant

1. Click Create

To edit a custom group:

1. Navigate to Groups
2. Click the custom group
3. Click Edit
4. Update the name, description, or permissions
5. Click Save

To delete a custom group:

1. Navigate to Groups
2. Click the ⋮ menu next to the custom group
3. Select Delete
4. Confirm the deletion

• Use email aliases: For shared accounts, use email aliases (e.g., cms-admin@company.com)
• Document permissions: Keep a record of who has access to what
• Regular reviews: Audit user access quarterly
• Offboarding process: Deactivate users immediately when they leave

• Descriptive names: Use clear, descriptive names for custom groups
• Document purpose: Add descriptions explaining when to use each group
• Avoid over-permissioning: Grant only necessary permissions
• Use site groups: Prefer site groups over system groups for site-specific access

• Strong passwords: Enforce password policy requirements
• MFA recommended: Enable multi-factor authentication for admin users
• Monitor activity: Review user activity logs regularly
• Limit admin access: Minimize the number of users with admin permissions

If a user reports login issues:

1. Check account status: Verify the user is not deactivated
2. Verify email: Confirm the email address is correct
3. Reset password: Initiate an admin password reset
4. Check MFA: Ensure MFA is configured correctly (if enabled)

If a user can't access a site:

1. Check site groups: Verify the user is in the appropriate site group
2. Check system groups: Confirm the user has necessary system permissions
3. Refresh session: Have the user log out and log back in
4. Review permissions: Ensure the group has the required permissions

The system prevents deleting or deactivating the last admin user. To change the admin:

1. Create a new admin user
2. Verify the new admin can log in
3. Remove admin permissions from the old user

• Creating Sites — Site groups are created automatically
• Security — Security requirements and best practices