Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Keycloak Provider
  4. API Docs
  5. GroupAdminPermissions
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.GroupAdminPermissions

keycloak logo keycloak logo
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows you to manage a fine-grained admin permission for Keycloak groups.

    This resource requires Fine-Grained Admin Permissions v2 (admin-fine-grained-authz:v2), available since Keycloak 26.2. See the docker-compose.yml for an example of how to enable this feature.

    Each instance of this resource represents one permission in Keycloak. A single permission can span multiple scopes, target multiple specific groups, and reference multiple policies.

    When adminPermissionsEnabled = true is set on the realm, Keycloak automatically creates an admin-permissions client that serves as the authorization resource server for all FGAPv2 admin permissions.

    Available scopes:

    • view — view the group’s configuration
    • manage — change the group’s configuration
    • view-members — view user details of the group’s members
    • manage-members — manage the users that belong to this group
    • manage-membership — add or remove members from this group

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    adminPermissionsEnabled: true,
});
const adminPermissions = keycloak.openid.getClientOutput({
    realmId: realm.id,
    clientId: "admin-permissions",
});
const admins = new keycloak.Group("admins", {
    realmId: realm.id,
    name: "admins",
});
const targetGroup = new keycloak.Group("target_group", {
    realmId: realm.id,
    name: "my-group",
});
const adminsPolicy = new keycloak.openid.ClientGroupPolicy("admins_policy", {
    realmId: realm.id,
    resourceServerId: adminPermissions.apply(adminPermissions => adminPermissions.id),
    name: "admins-policy",
    groups: [{
        id: admins.id,
        path: admins.path,
        extendChildren: false,
    }],
    logic: "POSITIVE",
    decisionStrategy: "UNANIMOUS",
});
// Permission targeting a specific group with multiple scopes.
const adminsManageTargetGroup = new keycloak.GroupAdminPermissions("admins_manage_target_group", {
    realmId: realm.id,
    name: "admins-manage-my-group",
    description: "Admins can view and manage members of my-group",
    decisionStrategy: "UNANIMOUS",
    groupIds: [targetGroup.id],
    scopes: [
        "view",
        "manage-members",
    ],
    policies: [adminsPolicy.id],
});
// Permission targeting ALL groups in the realm (group_ids omitted).
const adminsViewAllGroups = new keycloak.GroupAdminPermissions("admins_view_all_groups", {
    realmId: realm.id,
    name: "admins-can-view-all-groups",
    scopes: ["view"],
    policies: [adminsPolicy.id],
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    admin_permissions_enabled=True)
admin_permissions = keycloak.openid.get_client_output(realm_id=realm.id,
    client_id="admin-permissions")
admins = keycloak.Group("admins",
    realm_id=realm.id,
    name="admins")
target_group = keycloak.Group("target_group",
    realm_id=realm.id,
    name="my-group")
admins_policy = keycloak.openid.ClientGroupPolicy("admins_policy",
    realm_id=realm.id,
    resource_server_id=admin_permissions.id,
    name="admins-policy",
    groups=[{
        "id": admins.id,
        "path": admins.path,
        "extend_children": False,
    }],
    logic="POSITIVE",
    decision_strategy="UNANIMOUS")
# Permission targeting a specific group with multiple scopes.
admins_manage_target_group = keycloak.GroupAdminPermissions("admins_manage_target_group",
    realm_id=realm.id,
    name="admins-manage-my-group",
    description="Admins can view and manage members of my-group",
    decision_strategy="UNANIMOUS",
    group_ids=[target_group.id],
    scopes=[
        "view",
        "manage-members",
    ],
    policies=[admins_policy.id])
# Permission targeting ALL groups in the realm (group_ids omitted).
admins_view_all_groups = keycloak.GroupAdminPermissions("admins_view_all_groups",
    realm_id=realm.id,
    name="admins-can-view-all-groups",
    scopes=["view"],
    policies=[admins_policy.id])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:                   pulumi.String("my-realm"),
			AdminPermissionsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		adminPermissions := openid.LookupClientOutput(ctx, openid.GetClientOutputArgs{
			RealmId:  realm.ID(),
			ClientId: pulumi.String("admin-permissions"),
		}, nil)
		admins, err := keycloak.NewGroup(ctx, "admins", &keycloak.GroupArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins"),
		})
		if err != nil {
			return err
		}
		targetGroup, err := keycloak.NewGroup(ctx, "target_group", &keycloak.GroupArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("my-group"),
		})
		if err != nil {
			return err
		}
		adminsPolicy, err := openid.NewClientGroupPolicy(ctx, "admins_policy", &openid.ClientGroupPolicyArgs{
			RealmId: realm.ID(),
			ResourceServerId: pulumi.String(adminPermissions.ApplyT(func(adminPermissions openid.GetClientResult) (*string, error) {
				return adminPermissions.Id, nil
			}).(pulumi.StringPtrOutput)),
			Name: pulumi.String("admins-policy"),
			Groups: openid.ClientGroupPolicyGroupArray{
				&openid.ClientGroupPolicyGroupArgs{
					Id:             admins.ID(),
					Path:           admins.Path,
					ExtendChildren: pulumi.Bool(false),
				},
			},
			Logic:            pulumi.String("POSITIVE"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
		})
		if err != nil {
			return err
		}
		// Permission targeting a specific group with multiple scopes.
		_, err = keycloak.NewGroupAdminPermissions(ctx, "admins_manage_target_group", &keycloak.GroupAdminPermissionsArgs{
			RealmId:          realm.ID(),
			Name:             pulumi.String("admins-manage-my-group"),
			Description:      pulumi.String("Admins can view and manage members of my-group"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			GroupIds: pulumi.StringArray{
				targetGroup.ID(),
			},
			Scopes: pulumi.StringArray{
				pulumi.String("view"),
				pulumi.String("manage-members"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		// Permission targeting ALL groups in the realm (group_ids omitted).
		_, err = keycloak.NewGroupAdminPermissions(ctx, "admins_view_all_groups", &keycloak.GroupAdminPermissionsArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins-can-view-all-groups"),
			Scopes: pulumi.StringArray{
				pulumi.String("view"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        AdminPermissionsEnabled = true,
    });

    var adminPermissions = Keycloak.OpenId.GetClient.Invoke(new()
    {
        RealmId = realm.Id,
        ClientId = "admin-permissions",
    });

    var admins = new Keycloak.Group("admins", new()
    {
        RealmId = realm.Id,
        Name = "admins",
    });

    var targetGroup = new Keycloak.Group("target_group", new()
    {
        RealmId = realm.Id,
        Name = "my-group",
    });

    var adminsPolicy = new Keycloak.OpenId.ClientGroupPolicy("admins_policy", new()
    {
        RealmId = realm.Id,
        ResourceServerId = adminPermissions.Apply(getClientResult => getClientResult.Id),
        Name = "admins-policy",
        Groups = new[]
        {
            new Keycloak.OpenId.Inputs.ClientGroupPolicyGroupArgs
            {
                Id = admins.Id,
                Path = admins.Path,
                ExtendChildren = false,
            },
        },
        Logic = "POSITIVE",
        DecisionStrategy = "UNANIMOUS",
    });

    // Permission targeting a specific group with multiple scopes.
    var adminsManageTargetGroup = new Keycloak.GroupAdminPermissions("admins_manage_target_group", new()
    {
        RealmId = realm.Id,
        Name = "admins-manage-my-group",
        Description = "Admins can view and manage members of my-group",
        DecisionStrategy = "UNANIMOUS",
        GroupIds = new[]
        {
            targetGroup.Id,
        },
        Scopes = new[]
        {
            "view",
            "manage-members",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

    // Permission targeting ALL groups in the realm (group_ids omitted).
    var adminsViewAllGroups = new Keycloak.GroupAdminPermissions("admins_view_all_groups", new()
    {
        RealmId = realm.Id,
        Name = "admins-can-view-all-groups",
        Scopes = new[]
        {
            "view",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.OpenidFunctions;
import com.pulumi.keycloak.openid.inputs.GetClientArgs;
import com.pulumi.keycloak.Group;
import com.pulumi.keycloak.GroupArgs;
import com.pulumi.keycloak.openid.ClientGroupPolicy;
import com.pulumi.keycloak.openid.ClientGroupPolicyArgs;
import com.pulumi.keycloak.openid.inputs.ClientGroupPolicyGroupArgs;
import com.pulumi.keycloak.GroupAdminPermissions;
import com.pulumi.keycloak.GroupAdminPermissionsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .adminPermissionsEnabled(true)
            .build());

        final var adminPermissions = OpenidFunctions.getClient(GetClientArgs.builder()
            .realmId(realm.id())
            .clientId("admin-permissions")
            .build());

        var admins = new Group("admins", GroupArgs.builder()
            .realmId(realm.id())
            .name("admins")
            .build());

        var targetGroup = new Group("targetGroup", GroupArgs.builder()
            .realmId(realm.id())
            .name("my-group")
            .build());

        var adminsPolicy = new ClientGroupPolicy("adminsPolicy", ClientGroupPolicyArgs.builder()
            .realmId(realm.id())
            .resourceServerId(adminPermissions.applyValue(_adminPermissions -> _adminPermissions.id()))
            .name("admins-policy")
            .groups(ClientGroupPolicyGroupArgs.builder()
                .id(admins.id())
                .path(admins.path())
                .extendChildren(false)
                .build())
            .logic("POSITIVE")
            .decisionStrategy("UNANIMOUS")
            .build());

        // Permission targeting a specific group with multiple scopes.
        var adminsManageTargetGroup = new GroupAdminPermissions("adminsManageTargetGroup", GroupAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-manage-my-group")
            .description("Admins can view and manage members of my-group")
            .decisionStrategy("UNANIMOUS")
            .groupIds(targetGroup.id())
            .scopes(            
                "view",
                "manage-members")
            .policies(adminsPolicy.id())
            .build());

        // Permission targeting ALL groups in the realm (group_ids omitted).
        var adminsViewAllGroups = new GroupAdminPermissions("adminsViewAllGroups", GroupAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-can-view-all-groups")
            .scopes("view")
            .policies(adminsPolicy.id())
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      adminPermissionsEnabled: true
  admins:
    type: keycloak:Group
    properties:
      realmId: ${realm.id}
      name: admins
  targetGroup:
    type: keycloak:Group
    name: target_group
    properties:
      realmId: ${realm.id}
      name: my-group
  adminsPolicy:
    type: keycloak:openid:ClientGroupPolicy
    name: admins_policy
    properties:
      realmId: ${realm.id}
      resourceServerId: ${adminPermissions.id}
      name: admins-policy
      groups:
        - id: ${admins.id}
          path: ${admins.path}
          extendChildren: false
      logic: POSITIVE
      decisionStrategy: UNANIMOUS
  # Permission targeting a specific group with multiple scopes.
  adminsManageTargetGroup:
    type: keycloak:GroupAdminPermissions
    name: admins_manage_target_group
    properties:
      realmId: ${realm.id}
      name: admins-manage-my-group
      description: Admins can view and manage members of my-group
      decisionStrategy: UNANIMOUS
      groupIds:
        - ${targetGroup.id}
      scopes:
        - view
        - manage-members
      policies:
        - ${adminsPolicy.id}
  # Permission targeting ALL groups in the realm (group_ids omitted).
  adminsViewAllGroups:
    type: keycloak:GroupAdminPermissions
    name: admins_view_all_groups
    properties:
      realmId: ${realm.id}
      name: admins-can-view-all-groups
      scopes:
        - view
      policies:
        - ${adminsPolicy.id}
variables:
  adminPermissions:
    fn::invoke:
      function: keycloak:openid:getClient
      arguments:
        realmId: ${realm.id}
        clientId: admin-permissions

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

data "keycloak_openid_getclient" "adminPermissions" {
  realm_id  = keycloak_realm.realm.id
  client_id = "admin-permissions"
}

resource "keycloak_realm" "realm" {
  realm                     = "my-realm"
  admin_permissions_enabled = true
}
resource "keycloak_group" "admins" {
  realm_id = keycloak_realm.realm.id
  name     = "admins"
}
resource "keycloak_group" "target_group" {
  realm_id = keycloak_realm.realm.id
  name     = "my-group"
}
resource "keycloak_openid_clientgrouppolicy" "admins_policy" {
  realm_id           = keycloak_realm.realm.id
  resource_server_id = data.keycloak_openid_getclient.adminPermissions.id
  name               = "admins-policy"
  groups {
    id              = keycloak_group.admins.id
    path            = keycloak_group.admins.path
    extend_children = false
  }
  logic             = "POSITIVE"
  decision_strategy = "UNANIMOUS"
}
# Permission targeting a specific group with multiple scopes.
resource "keycloak_groupadminpermissions" "admins_manage_target_group" {
  realm_id          = keycloak_realm.realm.id
  name              = "admins-manage-my-group"
  description       = "Admins can view and manage members of my-group"
  decision_strategy = "UNANIMOUS"
  group_ids         = [keycloak_group.target_group.id]
  scopes            = ["view", "manage-members"]
  policies          = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}
# Permission targeting ALL groups in the realm (group_ids omitted).
resource "keycloak_groupadminpermissions" "admins_view_all_groups" {
  realm_id = keycloak_realm.realm.id
  name     = "admins-can-view-all-groups"
  scopes   = ["view"]
  policies = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}

    Create GroupAdminPermissions Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new GroupAdminPermissions(name: string, args: GroupAdminPermissionsArgs, opts?: CustomResourceOptions);
    @overload
def GroupAdminPermissions(resource_name: str,
                          args: GroupAdminPermissionsArgs,
                          opts: Optional[ResourceOptions] = None)

@overload
def GroupAdminPermissions(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          realm_id: Optional[str] = None,
                          scopes: Optional[Sequence[str]] = None,
                          decision_strategy: Optional[str] = None,
                          description: Optional[str] = None,
                          group_ids: Optional[Sequence[str]] = None,
                          name: Optional[str] = None,
                          policies: Optional[Sequence[str]] = None)
    func NewGroupAdminPermissions(ctx *Context, name string, args GroupAdminPermissionsArgs, opts ...ResourceOption) (*GroupAdminPermissions, error)
    public GroupAdminPermissions(string name, GroupAdminPermissionsArgs args, CustomResourceOptions? opts = null)
    public GroupAdminPermissions(String name, GroupAdminPermissionsArgs args)
public GroupAdminPermissions(String name, GroupAdminPermissionsArgs args, CustomResourceOptions options)

    type: keycloak:GroupAdminPermissions
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "keycloak_group_admin_permissions" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args GroupAdminPermissionsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args GroupAdminPermissionsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args GroupAdminPermissionsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args GroupAdminPermissionsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args GroupAdminPermissionsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var groupAdminPermissionsResource = new Keycloak.GroupAdminPermissions("groupAdminPermissionsResource", new()
{
    RealmId = "string",
    Scopes = new[]
    {
        "string",
    },
    DecisionStrategy = "string",
    Description = "string",
    GroupIds = new[]
    {
        "string",
    },
    Name = "string",
    Policies = new[]
    {
        "string",
    },
});

    example, err := keycloak.NewGroupAdminPermissions(ctx, "groupAdminPermissionsResource", &keycloak.GroupAdminPermissionsArgs{
	RealmId: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DecisionStrategy: pulumi.String("string"),
	Description:      pulumi.String("string"),
	GroupIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	Name: pulumi.String("string"),
	Policies: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "keycloak_group_admin_permissions" "groupAdminPermissionsResource" {
  lifecycle {
    create_before_destroy = true
  }
  realm_id          = "string"
  scopes            = ["string"]
  decision_strategy = "string"
  description       = "string"
  group_ids         = ["string"]
  name              = "string"
  policies          = ["string"]
}

    var groupAdminPermissionsResource = new GroupAdminPermissions("groupAdminPermissionsResource", GroupAdminPermissionsArgs.builder()
    .realmId("string")
    .scopes("string")
    .decisionStrategy("string")
    .description("string")
    .groupIds("string")
    .name("string")
    .policies("string")
    .build());

    group_admin_permissions_resource = keycloak.GroupAdminPermissions("groupAdminPermissionsResource",
    realm_id="string",
    scopes=["string"],
    decision_strategy="string",
    description="string",
    group_ids=["string"],
    name="string",
    policies=["string"])

    const groupAdminPermissionsResource = new keycloak.GroupAdminPermissions("groupAdminPermissionsResource", {
    realmId: "string",
    scopes: ["string"],
    decisionStrategy: "string",
    description: "string",
    groupIds: ["string"],
    name: "string",
    policies: ["string"],
});

    type: keycloak:GroupAdminPermissions
properties:
    decisionStrategy: string
    description: string
    groupIds:
        - string
    name: string
    policies:
        - string
    realmId: string
    scopes:
        - string

    GroupAdminPermissions Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The GroupAdminPermissions resource accepts the following input properties:

    RealmId string
    The realm in which to manage this permission.
    Scopes List<string>
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    GroupIds List<string>
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    Policies List<string>
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    Scopes []string
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    GroupIds []string
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    Policies []string
    Set of policy IDs to attach to the permission.
    realm_id string
    The realm in which to manage this permission.
    scopes list(string)
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    decision_strategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    group_ids list(string)
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies list(string)
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    groupIds List<String>
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId string
    The realm in which to manage this permission.
    scopes string[]
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    decisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    groupIds string[]
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies string[]
    Set of policy IDs to attach to the permission.
    realm_id str
    The realm in which to manage this permission.
    scopes Sequence[str]
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    decision_strategy str
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description str
    Description of the permission.
    group_ids Sequence[str]
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name str
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies Sequence[str]
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    groupIds List<String>
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies List<String>
    Set of policy IDs to attach to the permission.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the GroupAdminPermissions resource produces the following output properties:

    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    Enabled bool
    Always true when the resource exists.
    Id string
    The provider-assigned unique ID for this managed resource.
    PermissionId string
    The internal Keycloak UUID of the permission.
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    Enabled bool
    Always true when the resource exists.
    Id string
    The provider-assigned unique ID for this managed resource.
    PermissionId string
    The internal Keycloak UUID of the permission.
    authorization_resource_server_id string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled bool
    Always true when the resource exists.
    id string
    The provider-assigned unique ID for this managed resource.
    permission_id string
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled Boolean
    Always true when the resource exists.
    id String
    The provider-assigned unique ID for this managed resource.
    permissionId String
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled boolean
    Always true when the resource exists.
    id string
    The provider-assigned unique ID for this managed resource.
    permissionId string
    The internal Keycloak UUID of the permission.
    authorization_resource_server_id str
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled bool
    Always true when the resource exists.
    id str
    The provider-assigned unique ID for this managed resource.
    permission_id str
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled Boolean
    Always true when the resource exists.
    id String
    The provider-assigned unique ID for this managed resource.
    permissionId String
    The internal Keycloak UUID of the permission.

    Look up Existing GroupAdminPermissions Resource

    Get an existing GroupAdminPermissions resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: GroupAdminPermissionsState, opts?: CustomResourceOptions): GroupAdminPermissions
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        authorization_resource_server_id: Optional[str] = None,
        decision_strategy: Optional[str] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        group_ids: Optional[Sequence[str]] = None,
        name: Optional[str] = None,
        permission_id: Optional[str] = None,
        policies: Optional[Sequence[str]] = None,
        realm_id: Optional[str] = None,
        scopes: Optional[Sequence[str]] = None) -> GroupAdminPermissions
    func GetGroupAdminPermissions(ctx *Context, name string, id IDInput, state *GroupAdminPermissionsState, opts ...ResourceOption) (*GroupAdminPermissions, error)
    public static GroupAdminPermissions Get(string name, Input<string> id, GroupAdminPermissionsState? state, CustomResourceOptions? opts = null)
    public static GroupAdminPermissions get(String name, Output<String> id, GroupAdminPermissionsState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:GroupAdminPermissions    get:      id: ${id}
    import {
  to = keycloak_group_admin_permissions.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Enabled bool
    Always true when the resource exists.
    GroupIds List<string>
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    PermissionId string
    The internal Keycloak UUID of the permission.
    Policies List<string>
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    Scopes List<string>
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Enabled bool
    Always true when the resource exists.
    GroupIds []string
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    PermissionId string
    The internal Keycloak UUID of the permission.
    Policies []string
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    Scopes []string
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    authorization_resource_server_id string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decision_strategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    enabled bool
    Always true when the resource exists.
    group_ids list(string)
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permission_id string
    The internal Keycloak UUID of the permission.
    policies list(string)
    Set of policy IDs to attach to the permission.
    realm_id string
    The realm in which to manage this permission.
    scopes list(string)
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    enabled Boolean
    Always true when the resource exists.
    groupIds List<String>
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId String
    The internal Keycloak UUID of the permission.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    authorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    enabled boolean
    Always true when the resource exists.
    groupIds string[]
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId string
    The internal Keycloak UUID of the permission.
    policies string[]
    Set of policy IDs to attach to the permission.
    realmId string
    The realm in which to manage this permission.
    scopes string[]
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    authorization_resource_server_id str
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decision_strategy str
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description str
    Description of the permission.
    enabled bool
    Always true when the resource exists.
    group_ids Sequence[str]
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name str
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permission_id str
    The internal Keycloak UUID of the permission.
    policies Sequence[str]
    Set of policy IDs to attach to the permission.
    realm_id str
    The realm in which to manage this permission.
    scopes Sequence[str]
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    enabled Boolean
    Always true when the resource exists.
    groupIds List<String>
    Set of group UUIDs (keycloak_group.xxx.id) this permission applies to. When omitted or empty, the permission applies to all groups in the realm.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId String
    The internal Keycloak UUID of the permission.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, view-members, manage-members, manage-membership.

    Import

    Group admin permissions can be imported using {{realmId}}/{{permissionId}}:

    $ pulumi import keycloak:index/groupAdminPermissions:GroupAdminPermissions example my-realm/permission-uuid

    After import, run pulumi up to reconcile groupIds, scopes, and policies with your configuration.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo keycloak logo
    Viewing docs for Keycloak v6.13.0
    published on Saturday, Aug 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial