qumulo_role_member (Resource)¶

Assigns a user or group to an RBAC role on a Qumulo cluster.

This resource manages role membership, assigning identities (users or groups) to roles. The role itself is managed by the qumulo_role resource.

Example Usage¶

Assign Local User to Role¶

resource "qumulo_role" "backup_operators" {
  connection_profile = "prod"

  name        = "BackupOperators"
  description = "Role for backup operations"
  privileges  = ["PRIVILEGE_SNAPSHOT_READ", "PRIVILEGE_SNAPSHOT_WRITE"]
}

resource "qumulo_local_user" "alice" {
  connection_profile = "prod"

  name = "alice"
}

resource "qumulo_role_member" "alice_backup" {
  connection_profile = "prod"

  role_name = qumulo_role.backup_operators.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_user.alice.id
}

Assign AD Group to Role¶

resource "qumulo_role_member" "ad_admins" {
  connection_profile = "prod"

  role_name = "Administrators"
  domain    = "ACTIVE_DIRECTORY"
  auth_id   = "512"  # Domain Admins group
}

Multiple Members with for_each¶

locals {
  backup_users = {
    "alice" = qumulo_local_user.alice.id
    "bob"   = qumulo_local_user.bob.id
  }
}

resource "qumulo_role_member" "backup_members" {
  for_each = local.backup_users

  connection_profile = "prod"

  role_name = qumulo_role.backup_operators.name
  domain    = "LOCAL"
  auth_id   = each.value
}

Import¶

Role members can be imported using the format connection_profile,role_name,domain,auth_id:

terraform import qumulo_role_member.example prod,BackupOperators,LOCAL,1001

~> Note: Role membership cannot be updated in place. Changing the role, domain, or auth_id will recreate the resource.

Schema¶

Required¶

auth_id (String) The ID of the identity within its domain. For LOCAL domain, this is the user or group ID.
connection_profile (String) Name of a connection profile from the provider block. See the provider reference for how to define profiles.
domain (String) The authentication domain of the identity. Common values: LOCAL, ACTIVE_DIRECTORY, LDAP, POSIX_USER, POSIX_GROUP.
role_name (String) The name of the role to assign the identity to.

Read-Only¶

gid (Number) The POSIX group ID, if applicable.
id (String) The composite ID of the membership in the format role_name/domain/auth_id.
name (String) The display name of the identity as returned by the API.
sid (String) The Windows Security Identifier (SID), if applicable.
uid (Number) The POSIX user ID, if applicable.