cloudera.cloud.iam_group module – Create, update, or destroy CDP IAM Groups

Note

This module is part of the cloudera.cloud collection (version 2.5.1).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install cloudera.cloud. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: cloudera.cloud.iam_group.

Synopsis

  • Create, update, and destroy CDP IAM Groups.

  • A group is a named collection of users and machine users.

  • Roles and resource roles can be assigned to a group impacting all members of the group.

Requirements

The below requirements are needed on the host that executes this module.

  • cdpy

Parameters

Parameter

Comments

cdp_region

aliases: cdp_endpoint_region, endpoint_region

string

Specify the Cloudera Data Platform endpoint region.

Default: "default"

debug

aliases: debug_endpoints

boolean

Capture the CDP SDK debug log.

Choices:

  • false ← (default)

  • true

name

aliases: group_name

string / required

The name of the group.

The name must be unique, must have a maximum of 32 characters, and must contain only alphanumeric characters, “-”, and “_”.

The first character of the name must be alphabetic or an underscore.

Names are are not case-sensitive.

The group named “administrators” is reserved.

profile

string

If provided, the CDP SDK will use this value as its profile.

purge

aliases: replace

boolean

Flag to replace roles, users, and resource_roles with their specified values.

Choices:

  • false ← (default)

  • true

resource_roles

list / elements=dictionary

A list of resource role assignments.

resource

aliases: resourceCrn

string / required

The resource CRN for the rights assignment.

role

aliases: resourceRoleCrn

string / required

The resource role CRN to be assigned.

roles

list / elements=string

A single role or list of roles assigned to the group.

The role must be identified by its full CRN.

state

string

The state of the group.

Choices:

  • "present" ← (default)

  • "absent"

sync

aliases: sync_membership, sync_on_login

boolean

Whether group membership is synced when a user logs in.

The default is to sync group membership.

Choices:

  • false

  • true ← (default)

users

list / elements=string

A single user or list of users assigned to the group.

The user can be either the name or CRN.

verify_endpoint_tls

aliases: endpoint_tls

boolean

Verify the TLS certificates for the CDP endpoint.

Choices:

  • false

  • true ← (default)

Examples

# Note: These examples do not set authentication details.

# Create a group
- cloudera.cloud.iam_group:
    name: group-example

# Create a group with membership sync disabled
- cloudera.cloud.iam_group:
    state: present
    name: group-example
    sync: no

# Delete a group
- cloudera.cloud.iam_group:
    state: absent
    name: group-example

# Assign users to a group
- cloudera.cloud.iam_group:
    name: group-example
    users:
      - user-a
      - user-b

# Assign roles to a group
- cloudera.cloud.iam_group:
    name: group-example
    roles:
      - role-a
      - role-b

# Replace resource roles a group
- cloudera.cloud.iam_group:
    name: group-example
    resource_roles:
      - role-c
      - role-d
    purge: yes

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

group

dictionary

The information about the Group

Returned: always

creationDate

string

The date when this group record was created.

Returned: on success

Sample: "2020-07-06T12:24:05.531000+00:00"

crn

string

The CRN of the group.

Returned: on success

groupName

string

The group name.

Returned: on success

Sample: "example-01"

resource_roles

list / elements=dictionary

List of Resource-to-Role assignments, by CRN, that are associated with the group.

Returned: on success

resourceCrn

string

The CRN of the resource granted the rights of the role.

Returned: on success

resourceRoleCrn

string

The CRN of the CDP Role.

Returned: on success

roles

list / elements=string

List of Role CRNs assigned to the group.

Returned: on success

syncMembershipOnUserLogin

boolean

Flag indicating whether group membership is synced when a user logs in. The default is to sync group membership.

Returned: when supported

users

list / elements=string

List of User CRNs which are members of the group.

Returned: on success

sdk_out

string

Returns the captured CDP SDK log.

Returned: when supported

sdk_out_lines

list / elements=string

Returns a list of each line of the captured CDP SDK log.

Returned: when supported

Authors

  • Webster Mudge (@wmudge)

  • Dan Chaffelson (@chaffelson)