<a id="manage-roles"></a>

# Manage roles

#### NOTE
In the Juju ecosystem, roles are supported only when using [JAAS](https://documentation.ubuntu.com/jaas/).

<a id="reference-an-externally-managed-role"></a>

## Reference an externally managed role

To reference a role you’ve created outside of the current Terraform plan, in your Terraform plan add a data source of the `juju_jaas_role` type, specifying the name of the role. Optionally, you may also output the role’s UUID so you can later reference it in other resources. For example:

```terraform
data "juju_jaas_role" "test" {
  name = "role-0"
}
output "role_uuid" {
  value = data.juju_jaas_role.test.uuid
}
```

> See more: [`juju_jaas_role` (data source)](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/data-sources/jaas_role.md)

<a id="add-a-role"></a>

## Add a role

To add a role, in your Terraform plan create a resource of the `juju_jaas_role` type, specifying its name. For example:

```terraform
resource "juju_jaas_role" "development" {
  name = "model-reader"
}
```

> See more: [`juju_jaas_role` (resource)](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/jaas_role.md)

<a id="manage-access-to-a-role"></a>

## Manage access to a role

When using Juju with JAAS, to grant access to a role, in your Terraform plan add a resource type `juju_jaas_access_role`. Access can be granted to one or more users, service accounts, and/or groups. You must specify the role, the JAAS role access level, and the list of desired users, service accounts, and/or groups. For example:

#### NOTE
At present, the only valid JAAS role access level is `assignee`, so granting an entity access to a role effectively means giving them a particular role.

```terraform
resource "juju_jaas_access_role" "development" {
  role_id          = juju_jaas_role.target-role.uuid
  roles            = [juju_jaas_role.development.uuid]
  access           = "assignee"
  users            = ["foo@domain.com"]
  service_accounts = ["Client-ID-1", "Client-ID-2"]
}
```

> See more: [`juju_jaas_access_role`](https://documentation.ubuntu.com/terraform-provider-juju/latest/reference/terraform-provider/resources/jaas_access_role.md), [JAAS | Role access levels](https://canonical.com/juju/docs/jaas/v3/reference/role/#list-of-role-permissions)

## Manage a role’s access to a controller, cloud, model, or offer

> See more: [Manage access to a controller](https://documentation.ubuntu.com/terraform-provider-juju/latest/howto/manage-controllers.md#manage-access-to-a-controller), [Manage access to a cloud](https://documentation.ubuntu.com/terraform-provider-juju/latest/howto/manage-clouds.md#manage-access-to-a-cloud), [Manage annotations for a model](https://documentation.ubuntu.com/terraform-provider-juju/latest/howto/manage-models.md#manage-access-to-a-model), [Manage access to an offer](https://documentation.ubuntu.com/terraform-provider-juju/latest/howto/manage-offers.md#manage-access-to-an-offer)