terraform-provider/docs/resources/project_role.md

page_title, subcategory, description

page_title	subcategory	description
kms_project_role Resource - terraform-provider	Projects	Create custom project roles & save to Hanzo KMS. Only Machine Identity authentication is supported for this data source.

kms_project_role (Resource)

Create custom project roles & save to Hanzo KMS. Only Machine Identity authentication is supported for this data source.

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "kms_project" "example" {
  name = "example"
  slug = "example"
}

resource "kms_project_role" "biller" {
  project_slug = kms_project.example.slug
  name         = "Tester"
  description  = "A test role"
  slug         = "tester"
  permissions_v2 = [
    {
      subject = "integrations"
      action  = ["read", "create"]
    },
    {
      subject = "secrets"
      action  = ["read", "edit"]
      conditions = jsonencode({
        environment = {
          "$in" = ["dev", "prod"]
          "$eq" = "dev"
        }
        secretPath = {
          "$eq" = "/"
        }
      })
    },
  ]
}

Schema

Required

• name (String) The name for the new role
• project_slug (String) The slug of the project to create role
• slug (String) The slug for the new role

Optional

• description (String) The description for the new role. Defaults to an empty string.
• permissions (Attributes List) (DEPRECATED, USE permissions_v2. Refer to the migration guide in https://hanzo.ai/docs/internals/permissions#migrating-from-permission-v1-to-permission-v2) The permissions assigned to the project role (see below for nested schema)
• permissions_v2 (Attributes List) The permissions assigned to the project role. Refer to the documentation here https://hanzo.ai/docs/internals/permissions for its usage. (see below for nested schema)

Read-Only

• id (String) The ID of the role

Nested Schema for permissions

Required:

• action (String) Describe what action an entity can take. Enum: create,edit,delete,read
• subject (String) Describe what action an entity can take. Enum: role,member,groups,settings,integrations,webhooks,service-tokens,environments,tags,audit-logs,ip-allowlist,workspace,secrets,secret-rollback,secret-approval,secret-rotation,identity,certificate-authorities,certificates,certificate-policies,kms,pki-alerts,pki-collections

Optional:

• conditions (Attributes) The conditions to scope permissions (see below for nested schema)

Nested Schema for permissions.conditions

Optional:

• environment (String) The environment slug this permission should allow.
• secret_path (String) The secret path this permission should be scoped to

Nested Schema for permissions_v2

Required:

• action (Set of String) Describe what actions an entity can take.
• subject (String) Describe the entity the permission pertains to.

Optional:

• conditions (String) When specified, only matching conditions will be allowed to access given resource. Refer to the documentation in https://hanzo.ai/docs/internals/permissions#conditions for the complete list of supported properties and operators.
• inverted (Boolean) Whether rule forbids. Set this to true if permission forbids.