Groups

A group holds a set of permissions and grants them to every member. Both users and service accounts can be added to a group.

Groups can be managed here.

Built-in groups

Every organization starts with two built-in groups:

• admin grants full access to organization settings, billing, and permissions.
• user grants the baseline permissions for every member of the organization. This does include some write permissions.

A built-in group stays in step with the RWX defaults, so it picks up permissions that RWX adds later. You cannot rename or delete a built-in group.

Custom groups

Create a group for each distinct set of permissions you want to assign to people in your organization, then add the members who need them.

Adding or removing a permission to a group grants/revokes it immediately to everyone in the group.

Members

Add users and service accounts on the group's Members tab. Every member holds each permission the group grants.

You can also specify the group(s) for each member when inviting them to your organization.

Members hold the permissions of their groups in addition to any permissions you assign them directly.

Nesting groups

Nest one group under another to hand the parent's permissions down. Members of the child group hold everything the parent grants, in addition to what the child grants.

Manage nesting from the parent group's Nesting tab.

Managing a group

A group's manager can edit its permissions, members, and nesting, and can delete it. A manager can also add themselves to the group, therefore obtaining all the permissions the group grants.

For that reason, granting group:manage for a specific group requires authority to grant every permission the group grants, including permissions inherited through nesting. This additional check does not apply to organization-wide group:manage.

Whenever a permission is added to a group (or new layers of nesting are added), the confirmation message will list both the members of the group(s) who will receive new permissions and any group managers who would also gain the permission if they were to join the group they manage.

Deleting a group

Deleting a group removes its memberships and its nesting. Its members lose the permissions it granted, unless another group grants the same permissions. You cannot delete a built-in group.

Managing groups with Terraform

Use rwx_group to create custom groups, or the rwx_group data source to look up existing groups.

Manage direct permissions with rwx_group_permissions. It replaces the group's direct permissions on apply, including changes made outside Terraform. An empty set clears direct permissions; inherited grants remain.

Manage nesting with rwx_group_relationship.

For users, the rwx_user data source looks up an existing member by exact email, ignoring case. Pass its stable user id, not identity_id, to rwx_group_user_membership. For service accounts, use rwx_group_service_account_membership.

Each membership resource manages one direct membership. With directory sync, manage users through directory group mappings instead; manual user membership writes are rejected. Service account memberships remain supported.