1. A method comprising: storing a plurality of role definitions for one or more cloud provider systems; receiving a first request to assign a user to a first role, the first request specifying a first cloud computing resource of a plurality of cloud computing resources of a respective resource type in the one or more cloud provider systems; identifying a role definition corresponding to the first role, the identified role definition comprising the respective resource type and an action set permitted to be performed in the one or more cloud provider systems on the plurality of cloud computing resources of the respective resource type; creating the first role for the user on the first cloud computing resource, wherein creating the first role comprises associating the identified role definition with the first cloud computing resource and the user; receiving a second request to assign the user to a second role, the second request specifying a second cloud computing resource of the plurality of cloud computing resources of the respective resource type; and creating the second role for the user on the second cloud computing resource, wherein the identified role definition corresponds to the first role and the second role, and wherein creating the second role comprises associating the identified role definition with the first cloud computing resource and the user.