gantrycd_role (Resource)

A GantryCD custom role: a named, org-scoped bundle of permissions grantable to a user (gantrycd_role_assignment) or an SSO group (gantrycd_group_role_binding). System roles are read-only and are not manageable through this resource — only custom roles can be created, updated, or deleted here.

Example Usage

# A custom role is a named permission set. Each grant is (resource_type,
# action) optionally narrowed to one exact authorization label; omit
# authz_label to grant the action across the whole family.
resource "gantrycd_role" "payments_deployer" {
  key         = "payments-deployer"
  name        = "payments-deployer"
  description = "Trigger deployments and read logs for payments stacks only."

  permission {
    resource_type = "stack"
    action        = "deploy"
    authz_label   = "team-payments"
  }

  permission {
    resource_type = "stack"
    action        = "read_logs"
    authz_label   = "team-payments"
  }

  # Allowed to add or remove the team-payments label on stacks.
  permission {
    resource_type = "stack"
    action        = "assign_label"
    authz_label   = "team-payments"
  }
}

# Editing a protected metadata key uses the label family with an @key label.
resource "gantrycd_role" "cost_center_editor" {
  key  = "cost-center-editor"
  name = "cost-center-editor"

  permission {
    resource_type = "label"
    action        = "update"
    authz_label   = "@cost-center"
  }
}

Schema

Required

• key (String) Caller-chosen role key, unique within the organization. Immutable after creation; changing it replaces the role. Changing name leaves this key unchanged.
• name (String) Role name.

Optional

• description (String) Human-readable description of the role.
• permission (Block Set) A single (resource_type, action, authz_label) permission grant. Repeatable; at least one is required. Full replacement on every write. (see below for nested schema)

Read-Only

• id (String) Server-assigned role UUID. Used as the Terraform import id.
• identity_realm (String) Identity realm inherited from the configured provider.

Nested Schema for permission

Required:

• action (String) Action granted on the resource type (e.g. read, write). Validated server-side; the valid set is not duplicated here.
• resource_type (String) Resource type the permission applies to (e.g. stack, context). Validated server-side; the valid set is not duplicated here.

Optional:

• authz_label (String) Exact protected authorization label restricting this grant. Omit or use an empty string for all resources of this type. For assign_label, this is the label that may be added or removed; for label:update, it is the protected metadata key.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Import by role id. Only custom roles can be imported; system roles are read-only.
terraform import gantrycd_role.payments_deployer role_01HXXXXXXXXXXXXXXXXXXXXXXX