qumulo_role_member (Resource)¶

Assigns a user or group to an RBAC role on a Qumulo cluster.

This resource manages role membership, assigning identities (users or groups) to roles. The role itself is managed by the qumulo_role resource.

Example Usage¶

Installation¶

terraform {
  required_providers {
    qumulo = {
      source  = "qumulo-terraform-registry.s3.us-east-1.amazonaws.com/qumulo/qumulo"
      version = "~> 1.0"
    }
  }
}

Assign Local User to Role¶

resource "qumulo_role" "backup_operators" {
  connection_profile = "prod"

  name        = "BackupOperators"
  description = "Role for backup operations"
  privileges  = ["PRIVILEGE_SNAPSHOT_READ", "PRIVILEGE_SNAPSHOT_WRITE"]
}

resource "qumulo_local_user" "alice" {
  connection_profile = "prod"

  name = "alice"
}

resource "qumulo_role_member" "alice_backup" {
  connection_profile = "prod"

  role_name = qumulo_role.backup_operators.name
  domain    = "LOCAL"
  auth_id   = qumulo_local_user.alice.id
}

Assign AD Group to Role¶

resource "qumulo_role_member" "ad_admins" {
  connection_profile = "prod"

  role_name = "Administrators"
  domain    = "ACTIVE_DIRECTORY"
  auth_id   = "512"  # Domain Admins group
}

Multiple Members with for_each¶

locals {
  backup_users = {
    "alice" = qumulo_local_user.alice.id
    "bob"   = qumulo_local_user.bob.id
  }
}

resource "qumulo_role_member" "backup_members" {
  for_each = local.backup_users

  connection_profile = "prod"

  role_name = qumulo_role.backup_operators.name
  domain    = "LOCAL"
  auth_id   = each.value
}

Import¶

Role members can be imported using the format connection_profile,role_name,domain,auth_id:

terraform import qumulo_role_member.example prod,BackupOperators,LOCAL,1001

~> Note: Role membership cannot be updated in place. Changing the role, domain, or auth_id will recreate the resource.

Schema¶

Required¶

auth_id (String) The ID of the identity within its domain. For LOCAL domain, this is the user or group ID.
connection_profile (String) Name of a connection profile defined in the provider block.

Connection profiles centralize cluster credentials at the provider level. Define profiles in the provider block:

provider "qumulo" {
  connection_profiles = [
    {
      name                 = "prod"
      endpoint             = "https://cluster.example.com:8000"
      username             = "admin"
      password             = var.cluster_password
      insecure_skip_verify = true  # For self-signed certificates
    }
  ]
}

- domain (String) The authentication domain of the identity. Common values: LOCAL, ACTIVE_DIRECTORY, LDAP, POSIX_USER, POSIX_GROUP. - role_name (String) The name of the role to assign the identity to.

Read-Only¶

gid (Number) The POSIX group ID, if applicable.
id (String) The composite ID of the membership in the format role_name/domain/auth_id.
name (String) The display name of the identity as returned by the API.
sid (String) The Windows Security Identifier (SID), if applicable.
uid (Number) The POSIX user ID, if applicable.