qumulo_role (Resource)¶

Manages an RBAC role on a Qumulo cluster.

Roles define sets of privileges that can be assigned to users and groups. Role members (assigned identities) are managed separately using the qumulo_role_member resource.

Example Usage¶

Basic Role¶

resource "qumulo_role" "backup_operators" {
  connection_profile = "prod"

  name        = "BackupOperators"
  description = "Role for backup operations"
  privileges  = [
    "PRIVILEGE_SNAPSHOT_READ",
    "PRIVILEGE_SNAPSHOT_WRITE",
  ]
}

Role with All Snapshot Privileges¶

resource "qumulo_role" "snapshot_admins" {
  connection_profile = "prod"

  name        = "SnapshotAdmins"
  description = "Full snapshot management"
  privileges  = [
    "PRIVILEGE_SNAPSHOT_READ",
    "PRIVILEGE_SNAPSHOT_WRITE",
    "PRIVILEGE_SNAPSHOT_DELETE",
    "PRIVILEGE_SNAPSHOT_POLICY_READ",
    "PRIVILEGE_SNAPSHOT_POLICY_WRITE",
  ]
}

Multi-Cluster with for_each¶

variable "clusters" {
  type = set(string)
  default = ["prod", "dr"]
}

resource "qumulo_role" "observers" {
  for_each = var.clusters

  connection_profile = each.value

  name        = "Observers"
  description = "Read-only monitoring role"
  privileges  = [
    "PRIVILEGE_FS_ATTRIBUTES_READ",
    "PRIVILEGE_CLUSTER_READ",
  ]
}

Import¶

Roles can be imported using the format connection_profile,role_name:

terraform import qumulo_role.example prod,BackupOperators

~> Note: Role names cannot be changed after creation. Changing the name will recreate the role.

Schema¶

Required¶

connection_profile (String) Name of a connection profile from the provider block. See the provider reference for how to define profiles.
name (String) The name of the role. Must be unique on the cluster. Cannot be changed after creation.

Optional¶

description (String) A description of the role's purpose.
privileges (List of String) List of privileges granted by this role. See Qumulo documentation for available privileges.