qumulo_role (Resource)

Manages an RBAC role on a Qumulo cluster.

Roles define sets of privileges that can be assigned to users and groups. Role members (assigned identities) are managed separately using the qumulo_role_member resource.

Example Usage

Installation

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Basic Role

resource "qumulo_role" "backup_operators" {
  connection_profile = "prod"

  name        = "BackupOperators"
  description = "Role for backup operations"
  privileges  = [
    "PRIVILEGE_SNAPSHOT_READ",
    "PRIVILEGE_SNAPSHOT_WRITE",
  ]
}

Role with All Snapshot Privileges

resource "qumulo_role" "snapshot_admins" {
  connection_profile = "prod"

  name        = "SnapshotAdmins"
  description = "Full snapshot management"
  privileges  = [
    "PRIVILEGE_SNAPSHOT_READ",
    "PRIVILEGE_SNAPSHOT_WRITE",
    "PRIVILEGE_SNAPSHOT_DELETE",
    "PRIVILEGE_SNAPSHOT_POLICY_READ",
    "PRIVILEGE_SNAPSHOT_POLICY_WRITE",
  ]
}

Multi-Cluster with for_each

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_role" "observers" {
  for_each = var.clusters

  connection_profile = each.value

  name        = "Observers"
  description = "Read-only monitoring role"
  privileges  = [
    "PRIVILEGE_FS_ATTRIBUTES_READ",
    "PRIVILEGE_CLUSTER_READ",
  ]
}

Import

Roles can be imported using the format connection_profile,role_name:

terraform import qumulo_role.example prod,BackupOperators

~> Note: Role names cannot be changed after creation. Changing the name will recreate the role.

Schema

Required

• connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

- name (String) The name of the role. Must be unique on the cluster. Cannot be changed after creation.

Optional

• description (String) A description of the role's purpose.
• privileges (List of String) List of privileges granted by this role. See Qumulo documentation for available privileges.