terraform-provider/docs/resources/org_role.md

page_title, subcategory, description

page_title	subcategory	description
kms_org_role Resource - terraform-provider	Organization	Create custom organization roles & save to Hanzo KMS. Only Machine Identity authentication is supported for this data source.

kms_org_role (Resource)

Create custom organization roles & save to Hanzo KMS. Only Machine Identity authentication is supported for this data source.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "http://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_org_role" "tester" {
  name        = "Tester"
  description = "A test role"
  slug        = "tester"
  permissions = [
    {
      subject = "project"
      action  = ["create"]
    },
    {
      subject = "app-connections"
      action  = ["read", "create"]
      conditions = jsonencode({
        connectionId = {
          "$eq" = "<connection-id>"
        }
      })
    },
  ]
}

Schema

Required

• name (String) The name for the new role
• permissions (Attributes List) The permissions assigned to the organization role. Refer to the documentation here https://hanzo.ai/docs/internals/permissions for its usage. (see below for nested schema)
• slug (String) The slug for the new role

Optional

• description (String) The description for the new role. Defaults to an empty string.

Read-Only

• id (String) The ID of the role

Nested Schema for permissions

Required:

• action (Set of String) Describe what actions an entity can take.
• subject (String) Describe the entity the permission pertains to.

Optional:

• conditions (String) When specified, only matching conditions will be allowed to access given resource. Refer to the documentation in https://hanzo.ai/docs/internals/permissions#conditions for the complete list of supported properties and operators.
• inverted (Boolean) Whether rule forbids. Set this to true if permission forbids.