docs: add Data Sources permission callout and fix BYOC IAM anchor

[mintlify]

Summary

Ports ClickHouse/clickhouse-docs#6328 — documents that the Data Sources tab currently requires the Manage and Delete Selected Services permission, and fixes a broken anchor in the BYOC security playbook.

Changes

• manage-custom-roles.mdx: added a Note callout in the "Click Allow and select permission scope" step about Data Sources tab requiring Manage and Delete Selected Services.
• console-roles.mdx: updated the control-plane:service:manage-clickpipes row to note that Data Sources tab access currently requires control-plane:service:manage.
• byoc-security-playbook.mdx: updated link anchor from #cloudformation-iam-roles to #aws-iam-roles.
• privilege.mdx (BYOC reference): renamed heading "CloudFormation IAM roles" → "AWS IAM roles" (anchor updated accordingly) to match the upstream rename and keep the playbook link working.

---

Note

Low Risk
Documentation-only updates to console RBAC guidance and BYOC cross-links; no runtime, auth, or infrastructure code changes.

Overview
Documents that opening the Data Sources tab in ClickHouse Cloud currently needs the Manage and Delete Selected Services permission (control-plane:service:manage), not only ClickPipes management rights.

A Note was added in the custom-role creation flow (manage-custom-roles.mdx), and the ClickPipes row in console-roles.mdx was extended with the same requirement so RBAC setup matches product behavior.

BYOC docs were aligned so the IAM reference heading is AWS IAM roles (#aws-iam-roles) instead of CloudFormation IAM roles, and the BYOC security playbook link was updated to that anchor so incident-response guidance no longer points at a broken fragment.

^{Reviewed by Cursor Bugbot for commit 712e597. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
ClickHouse-docs	🟢 Ready	View Preview	Jun 4, 2026, 11:37 AM