Create roles and assign members¶

When you finish, a custom BackupOperators role grants snapshot privileges to everyone in a local backup-team group.

Before you start¶

A Qumulo cluster whose REST API on port 8000 you can reach from this machine
An admin account on the cluster for the connection profile
Terraform 1.11 or later
For Active Directory identities, a cluster already joined to Active Directory

1. Copy the configuration¶

Save this as main.tf in an empty directory.

terraform {
  required_version = ">= 1.11"
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "cluster1"
      endpoint             = "https://cluster.example.com:8000" # <-- Replace with your cluster's REST API endpoint
      username             = "admin"
      password             = "YourClusterPassword123!" # <-- Replace with your admin password
      insecure_skip_verify = true
    },
  ]
}

resource "qumulo_role" "backup_operators" {
  connection_profile = "cluster1"

  name        = "BackupOperators"
  description = "Manages snapshots and snapshot policies"
  privileges = [
    "PRIVILEGE_SNAPSHOT_READ",
    "PRIVILEGE_SNAPSHOT_WRITE",
    "PRIVILEGE_SNAPSHOT_DELETE",
    "PRIVILEGE_SNAPSHOT_POLICY_READ",
    "PRIVILEGE_SNAPSHOT_POLICY_WRITE",
  ]
}

resource "qumulo_local_group" "backup_team" {
  connection_profile = "cluster1"

  name = "backup-team"
}

resource "qumulo_role_member" "backup_team" {
  connection_profile = "cluster1"

  role_name = qumulo_role.backup_operators.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_group.backup_team.id
}

output "role_member" {
  value = qumulo_role_member.backup_team.name
}

Replace the two values marked <-- Replace, and leave the rest as written. Delete insecure_skip_verify if the cluster's certificate is signed by a CA your machine trusts.

2. Choose the privileges and the members¶

To grant different privileges, edit the privileges list.
To give the role to an existing local user or group, set auth_id to its ID and delete the qumulo_local_group block.
To give the role to an Active Directory identity, set domain = "ACTIVE_DIRECTORY" and set auth_id to the identity's ID in that domain.
To add a member to the built-in administrator role, set role_name = "Administrators".
To give one identity several roles, add one qumulo_role_member block per role.

The plan in step 3 shows one qumulo_role_member for each role and identity pair.

3. Apply¶

terraform init -upgrade
terraform plan
terraform apply

The plan ends with Plan: 3 to add, 0 to change, 0 to destroy. The apply ends with Apply complete! Resources: 3 added, 0 changed, 0 destroyed., followed by the role_member output.

4. Check the membership¶

The role_member output prints backup-team, the name the cluster reports for the new member. Every user you add to backup-team gains the role's privileges.

Next¶

Fill the group with local users and groups, and read how roles and privileges work in Qumulo's RBAC documentation. The qumulo_role_member reference lists every attribute, Manage several clusters from one configuration repeats these roles across a fleet, and the cluster troubleshooting guide helps if a step fails.