IAM

Overview

An Identity on Snap CD can be either a User or a Service Principal. Access for both is controlled by an integrated OIDC Identity Provider.

Identities can be assigned to Groups.

Roles can be assigned either to a Group, or directly to an Identity.

Principals

User

A User represents a human identity authenticated via the integrated OIDC Identity Provider. Users sign in interactively using a browser and are typically associated with an individual person within your organization. Sign-in can be federated to an external login provider. Snap CD supports the following external login providers: Microsoft Entra, Okta, Auth0, Google and GitHub.

You can see the full User specification here.

NOTE: The Terraform provider only provides a User data source; creation must be done via the Dashboard.

Service Principal

A Service Principal is also known as an OIDC “Application” or “Client”, and is identified by “Client Id / Client Secret” credentials. Service Principals can exchange their Client Id / Client Secret for an Access Token, which can be used as a “Bearer” token in the authorization header when making requests to the Server’s Web API.

Runners need to have a Service Principal attached to them. You can also use a Service Principal to authenticate the Snap CD Terraform Provider.

You can see the full Service Principal specification here.

NOTE: The Terraform provider only provides a Service Principal data source; creation must be done via the Dashboard or Web API.

Group

Identities can be assigned to Groups. Note that nesting of Groups is currently not supported.

You can see the full Group specification here.

Role Assignments

Roles are assigned at specific scopes using role assignment resources. Each scope has its own Terraform resource and set of available roles.

Common Fields

All role assignment resources share these fields:

Field	Description
`principal_id`	ID of the User, Service Principal, or Group
`principal_discriminator`	Type of principal: `User`, `ServicePrincipal`, or `Group`
`role_name`	Name of the role to assign (varies by scope)

Organization Roles

Organization roles apply system-wide.

Terraform Resource: snapcd_organization_role_assignment

Role	Description
`Owner`	Full control over the entire organization
`Contributor`	Can read and create resources
`Reader`	Read-only access across the organization
`StackCreator`	Can create new Stacks
`StackContributor`	Can contribute to all Stacks
`StackReader`	Read-only access to all Stacks
`IdentityAccessManager`	Can manage role assignments
`JobManager`	Can manage job execution
`SourceChangeNotifier`	Can trigger source change notifications
`SubscriptionManager`	Can manage the organization’s subscription
`RunnerCreator`	Can create new Runners
`RunnerContributor`	Can contribute to all Runners
`RunnerReader`	Read-only access to all Runners
`AgentCreator`	Can create new Agents
`AgentContributor`	Can contribute to all Agents
`AgentReader`	Read-only access to all Agents
`IntegrationCreator`	Can create new Integrations
`IntegrationContributor`	Can contribute to all Integrations
`IntegrationReader`	Read-only access to all Integrations
`SourceRefresherPreselectionCreator`	Can create source refresher preselections
`SourceRefresherPreselectionContributor`	Can contribute to source refresher preselections
`SourceRefresherPreselectionReader`	Read-only access to source refresher preselections

Stack Roles

Stack roles apply to a specific Stack and its child Namespaces and Modules.

Terraform Resource: snapcd_stack_role_assignment

Additional Field: stack_id - ID of the Stack

Role	Description
`Owner`	Full control over the Stack and all child resources
`Contributor`	Can read Stack and create child resources
`Reader`	Read-only access to Stack and child resources
`NamespaceCreator`	Can create new Namespaces in this Stack
`IdentityAccessManager`	Can manage role assignments on the Stack
`SourceChangeNotifier`	Can trigger source change notifications
`JobManager`	Can manage job execution

Namespace Roles

Namespace roles apply to a specific Namespace and its child Modules.

Terraform Resource: snapcd_namespace_role_assignment

Additional Field: namespace_id - ID of the Namespace

Role	Description
`Owner`	Full control over the Namespace and all child Modules
`Contributor`	Can read Namespace and create Modules
`Reader`	Read-only access to Namespace and child Modules
`ModuleCreator`	Can create new Modules in this Namespace
`IdentityAccessManager`	Can manage role assignments on the Namespace
`SourceChangeNotifier`	Can trigger source change notifications
`JobManager`	Can manage job execution

Module Roles

Module roles apply to a specific Module.

Terraform Resource: snapcd_module_role_assignment

Additional Field: module_id - ID of the Module

Role	Description
`Owner`	Full control over the Module
`Contributor`	Can read and modify the Module
`Reader`	Read-only access to the Module
`IdentityAccessManager`	Can manage role assignments on the Module
`SourceChangeNotifier`	Can trigger source change notifications
`JobManager`	Can manage job execution

Runner Roles

Runner roles apply to a specific Runner.

Terraform Resource: snapcd_runner_role_assignment

Additional Field: runner_id - ID of the Runner

Role	Description
`Owner`	Full control over the Runner
`Contributor`	Can read and modify the Runner
`Reader`	Read-only access to the Runner
`IdentityAccessManager`	Can manage role assignments on the Runner

Agent Roles

Agent roles apply to a specific Agent.

Terraform Resource: snapcd_agent_role_assignment

Additional Field: agent_id - ID of the Agent

Role	Description
`Owner`	Full control over the Agent
`Contributor`	Can read and modify the Agent
`Reader`	Read-only access to the Agent
`IdentityAccessManager`	Can manage role assignments on the Agent

Integration Roles

Integration roles apply to a specific Integration.

Terraform Resource: snapcd_integration_role_assignment

Additional Field: integration_id - ID of the Integration

Role	Description
`Owner`	Full control over the Integration
`Contributor`	Can read and modify the Integration
`Reader`	Read-only access to the Integration
`IdentityAccessManager`	Can manage role assignments on the Integration

Examples

Assign a Service Principal as Module Owner

resource "snapcd_module_role_assignment" "deployer" {
  module_id               = snapcd_module.my_module.id
  principal_id            = data.snapcd_service_principal.deployer.id
  principal_discriminator = "ServicePrincipal"
  role_name               = "Owner"
}

Assign a User as Stack Reader

resource "snapcd_stack_role_assignment" "viewer" {
  stack_id                = snapcd_stack.production.id
  principal_id            = data.snapcd_user.viewer.id
  principal_discriminator = "User"
  role_name               = "Reader"
}

Assign a Group as Namespace Contributor

resource "snapcd_namespace_role_assignment" "dev_team" {
  namespace_id            = snapcd_namespace.backend.id
  principal_id            = snapcd_group.developers.id
  principal_discriminator = "Group"
  role_name               = "Contributor"
}

Last updated on July 2, 2026