RbacResourceGroup

The RbacResourceGroup resource creates Active Directory DomainLocal security groups. These are typically used for role-based access control — granting groups of users specific permissions on resources.

Structure

- type: rbacResourceGroup
  name: rbacsysadmin                            # unique identifier within the RGT
  groupName: "{{deployment.shortid}}-sysadmin"  # AD group name (supports expressions)
  members:                                      # optional, members to add to the group
    - "svc-admin"                               # reference users or groups within the same domain directly
    - "otherdomain\\app-team"                   # use domain\user or domain\group for other domains

Key	Required	Description
type	Yes	Must be rbacResourceGroup
name	Yes	Unique identifier within the RGT (used in expressions)
groupName	Yes	The actual AD group name. Supports expressions.
members	No	List of users or groups to add as members. Supports expressions.

Naming Format

The final AD group name is determined by combining the AD_RBACRESOURCEGROUP_FORMAT variable with groupName:

• Format variable: AD_RBACRESOURCEGROUP_FORMAT uses {0} as a placeholder for the groupName value
• Default: {0} (the groupName is used as-is)
• Example: If AD_RBACRESOURCEGROUP_FORMAT is .{{tenant.name}}-{{deployment.shortid}}-{0}-l and groupName is foo, the final name is .acme-0fa0bb-foo-l

The group is created in the AD_GROUP_RESOURCE_OU organizational unit.

Reference Format

Use {{rbacresourcegroup.<name>.<property>}} to reference an RBAC group in expressions.

Given a group with name: rbacfoo, groupName: foo, and AD_RBACRESOURCEGROUP_FORMAT: .prefix-{{deployment.shortid}}-{0}-l:

Expression	Type	Example output
{{rbacresourcegroup.rbacfoo}}	string	.prefix-0fa0bb-foo-l
{{rbacresourcegroup.rbacfoo.groupname}}	string	.prefix-0fa0bb-foo-l

Modifiers (Variables)

Variable	Type	Required	Level	Default	Description
DEFAULT_AD_RESOURCEPROVIDER	string	Yes	Variable	—	Identifier of the Active Directory resource provider
AD_RBACRESOURCEGROUP_FORMAT	string	No	ResourceProvider	{0}	Naming format. {0} is replaced by groupName. Supports expressions.
AD_GROUP_RESOURCE_OU	string	No	ResourceProvider	—	OU path (DistinguishedName) where the group is created

Example

An RBAC group for SQL Server sysadmin access, with a service account as a member:

resources:
  - type: rbacResourceGroup
    name: rbacsysadmin
    groupName: "{{deployment.shortid}}-sysadmin"
    members:
      - "yourdomain\\svcaccount"
  - type: serviceAccount
    name: svcdb
    svcName: "db-{{deployment.shortid}}"
    memberOf:
      - "yourdomain\\{{rbacresourcegroup.rbacsysadmin.groupname}}"
  - type: computeNode
    computeType: virtualMachine
    name: vmdb
    image: win2022
    cpu: 4
    memory: 32
    domain: yourdomain.local
    config:
      - name: install-sql
        variables:
          mssql_version: sql22dev
          mssql_sysadmin_accounts: ["yourdomain\\{{rbacresourcegroup.rbacsysadmin.groupname}}"]
          mssql_sqlsvc_account: "yourdomain\\{{serviceaccount.svcdb.svcname}}"
          mssql_sqlsvc_account_pass: "{{serviceaccount.svcdb.svcpassword}}"

---

Next: Cluster