Groups

This topic describes how to create and manage groups of users in HashiCorp Cloud Platform (HCP). A group is a set of one or more user identities that you want to manage as a single identity.

Introduction

In HCP, groups enable you to manage permissions for multiple users in a consistent manner. You can assign groups to roles and associate them with one or more projects, just as you would for individual user identities. This approach enables you to logically manage users and permissions at scale.

Each group can have a different role for each project it is associated with. The following example illustrates this capability:

1. An organization has one user assigned the Admin IAM role and three users assigned the Viewer role.
2. The admin creates a group named engineers and adds the viewers as members.
3. The admin assigns the engineers group to three projects in the HCP organization, and assigns the group to the following projects and roles:
   • Admin role in the Development project
   • Contributor role in the Staging project
   • Viewer role in the Production project

As a result, members of the engineers group would be able to perform administrative actions in the Development project, create and modify resources in the Staging project, and continue to read resources in the Production project.

To learn more about user permissions, refer to User permissions.

Group provisioning methods

HCP supports two methods for creating and managing groups in your organization:

• Manual provisioning - Create groups directly in HCP and manually manage membership. This is the default method.
• SCIM provisioning - Automatically sync groups and their membership from your identity provider when SCIM is enabled. Groups are created, updated, and removed based on changes in your identity provider.

For more information about SCIM provisioning, refer to SCIM provisioning.

Requirements

You must have admin permissions for your organization to create and manage groups and users.

Create a group

When SCIM provisioning is enabled for your organization, groups are automatically synchronized from your identity provider. You can manually create groups in HCP, but the SCIM-managed identity provider group takes precedence over an existing HCP group with the same name. As a result, the SCIM-managed identity provider group replaces the manually created HCP group. For more information, refer to SCIM provisioning.

1. Log into the HCP portal and choose your organization.
2. Click Access control (IAM) to view a list of users.
3. Click Groups.
4. Click Create group.
5. Enter a group name and description. Group names must be unique across the entire organization.
6. Click Create group.
7. Click Add group members to add users to the group.
8. Choose users to add to the group and click Add group members. If you expect a specific user that does not appear in the list, verify that the user has joined the HCP organization.

Assign group roles for members

Once members have been added to your group, you can manage their group role. Within a group, each role has certain permissions that determine who can view and manage the group.

Group role permissions

The following table describes role permissions for each group role.

Edit group roles

1. Log into HCP Portal and choose your organization.
2. Click Access Control (IAM).
3. Click Groups.
4. Click into the group you want to edit group roles in.
5. Under members, choose the user's role you want to edit and click Edit role from the drop-down.
6. Choose the group role for that user and click Save.

Assign a project and role

1. From the HCP portal choose the project you want to assign a group to.
2. From the project dashboard, click Access control (IAM).
3. Click Add new assignment.
4. Search for and then select the groups you want to assign projects and roles to.
5. Select a service and role to set the group's permissions for the project.
6. Click Save.

Manage SCIM-provisioned groups

When SCIM provisioning is enabled, group lifecycle management is handled by your identity provider:

• Group creation: Groups are automatically created in HCP when they exist in your identity provider.
• Group updates: Group name changes in your identity provider automatically sync to HCP.
• Membership management: Group membership is controlled in your identity provider and automatically synced to HCP.
• Group removal: Groups deleted from your identity provider are automatically removed from HCP.
• Role assignments: You must assign roles to SCIM-provisioned groups in HCP.

To identify SCIM-provisioned groups, check the SCIM provisioning column in the groups list. Groups with a status of Synced are managed by SCIM.

When a group is SCIM-provisioned, any existing HCP group membership is replaced with the membership from your identity provider.

For more information, refer to SCIM provisioning.