CloudKit – Unable to Assign Custom Security Role to User

Question

vzw1043 OP

Created 4d

Replies 1

Boosts 0

Participants 2

Hello Apple Developer Support,

I'm developing an iOS application called LuckyWinston that uses CloudKit for its backend.

I'm trying to assign a custom CloudKit security role to a specific user in the public database.

However, I've encountered the following issues:

The built-in Users record type cannot be queried normally.
Attempting to fetch the user record directly by its record ID also fails.
I haven't found a supported method in the current CloudKit Console for assigning a custom security role to an individual user.

I understand that CloudKit restricts queries against its built-in user records, but I would like clarification on how developers are expected to assign custom security roles.

My questions are:

Is assigning custom security roles to individual CloudKit users still supported?
If so, what is the correct procedure using the current CloudKit Console or supported APIs?
Is there an alternative supported method for assigning user-specific permissions without exposing sensitive records?
If individual custom-role assignments are no longer supported, what architecture does Apple recommend?

I want to ensure that LuckyWinston follows Apple's recommended CloudKit security practices before proceeding further.

Thank you for your assistance.

Answered by DTS Engineer in 911614022

Yes, assigning custom security roles to an individual CloudKit user is supported. You can add a security role with the following steps:

Log in CloudKit Console. Be sure you pick the right team and the CloudKit container.
On the sidebar, click Schema > Security Roles, then click the "+" button to add a role.
Select the role, and on right pane, click "+ Add record type", pick the record type and permissions for the role, and then click Save.

You can then assign the security role to a user:

Click Records On the sidebar, pick Public Database > _defaultZone > Query Records > Users > All, and then click Query Records. CloudKit Console should show you all the user records.
Pick a user, and then in the right pane, you should see that the security role you just added shows up under the Security Role section.
Checking the role assigns it to the user.

CloudKit identifies a user record with the "Name" field in the Users record type, which is a unique ID CloudKit generated. If you would associate the ID with your own data, add new fields to the record type. Then, in your app, use fetchUserRecordID to grab the record ID of the current user, and use it to fetch the user record and access fields you added.

Best,
——
Ziqiao Chen
 Worldwide Developer Relations.

Answer 1 · 14h

DTS Engineer OP

Apple

14h

Recommended

Yes, assigning custom security roles to an individual CloudKit user is supported. You can add a security role with the following steps:

Log in CloudKit Console. Be sure you pick the right team and the CloudKit container.
On the sidebar, click Schema > Security Roles, then click the "+" button to add a role.
Select the role, and on right pane, click "+ Add record type", pick the record type and permissions for the role, and then click Save.

You can then assign the security role to a user:

Click Records On the sidebar, pick Public Database > _defaultZone > Query Records > Users > All, and then click Query Records. CloudKit Console should show you all the user records.
Pick a user, and then in the right pane, you should see that the security role you just added shows up under the Security Role section.
Checking the role assigns it to the user.

CloudKit identifies a user record with the "Name" field in the Users record type, which is a unique ID CloudKit generated. If you would associate the ID with your own data, add new fields to the record type. Then, in your app, use fetchUserRecordID to grab the record ID of the current user, and use it to fetch the user record and access fields you added.

Best,
——
Ziqiao Chen
 Worldwide Developer Relations.