Security, Access Control, and Multitenancy
This domain tests who can do what, how identities are authenticated, how data is protected at rest and in flight, and how far PowerStore isolation goes when several teams share a cluster. It rewards precision about the limits of role-based access.
Access control
- PowerStore uses role-based accounts. Administrator has full control including security settings; Storage Administrator covers storage configuration and host management; VM Administrator applies to appsON and vSphere operations. Roles are system-wide rather than scoped to a single volume or NAS server.
- Local users can be created, but enterprise deployments integrate AD or LDAP so group membership drives role assignment. Correct DNS and NTP are prerequisites.
- Sessions, password policy, and audit logging should be reviewed as part of hardening. Default or shared accounts are a finding in any audit.
Data protection and transport
- Data-at-rest encryption uses self-encrypting drives with an internal or external key manager; choose the mode during deployment because changing it later is a project, not a checkbox.
- Management access should use signed certificates rather than the default, and SupportAssist connectivity should follow the approved path.
- Block access can be restricted with CHAP for iSCSI; file access with SMB permissions, NFS export rules, and Kerberos where required.
Multitenancy
PowerStore isolates tenants primarily in the data path: separate NAS servers for file tenants, separate host groups and volumes for block tenants, and separate VLANs or subnets for traffic. Because administrative roles are not scoped per NAS server, a true multi-tenant service needs process controls and separate clusters where regulatory isolation is required.
Worked example
Two departments share a four-appliance cluster. Create a NAS server and file VLAN per department, separate host groups and volumes for their block workloads, and assign Storage Administrator only to the storage operations team. Do not promise departmental administrators that they will see only their own objects in PowerStore Manager; the role model does not provide that scoping.
Traps that cost marks
- Assuming a Storage Administrator can be limited to one NAS server or one volume group.
- Joining AD or LDAP before time sync and DNS are correct.
- Treating NAS server separation as complete tenant isolation, including administrative visibility.
- Leaving default certificates or shared local accounts in place.