Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Keycloak Provider
  4. API Docs
  5. RoleAdminPermissions
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.RoleAdminPermissions

keycloak logo keycloak logo
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows you to manage a fine-grained admin permission for Keycloak roles.

    This resource requires Fine-Grained Admin Permissions v2 (admin-fine-grained-authz:v2), available since Keycloak 26.2. See the docker-compose.yml for an example of how to enable this feature.

    Each instance of this resource represents one permission in Keycloak (matching what you see when you click “Create permission” in the Keycloak UI). A single permission can span multiple scopes, target multiple specific roles, and reference multiple policies.

    When adminPermissionsEnabled = true is set on the realm, Keycloak automatically creates an admin-permissions client that serves as the authorization resource server for all FGAPv2 admin permissions.

    Available scopes:

    • map-role — map this role to users, groups, or clients
    • map-role-client-scope — use this role as a client scope
    • map-role-composite — add this role as a composite to another role

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    adminPermissionsEnabled: true,
});
const adminPermissions = keycloak.openid.getClientOutput({
    realmId: realm.id,
    clientId: "admin-permissions",
});
const roleA = new keycloak.Role("role_a", {
    realmId: realm.id,
    name: "role-a",
});
const roleB = new keycloak.Role("role_b", {
    realmId: realm.id,
    name: "role-b",
});
const admins = new keycloak.Group("admins", {
    realmId: realm.id,
    name: "admins",
});
const adminsPolicy = new keycloak.openid.ClientGroupPolicy("admins_policy", {
    realmId: realm.id,
    resourceServerId: adminPermissions.apply(adminPermissions => adminPermissions.id),
    name: "admins-policy",
    groups: [{
        id: admins.id,
        path: admins.path,
        extendChildren: false,
    }],
    logic: "POSITIVE",
    decisionStrategy: "UNANIMOUS",
});
// Permission targeting two specific roles with multiple scopes.
const adminsMapSpecificRoles = new keycloak.RoleAdminPermissions("admins_map_specific_roles", {
    realmId: realm.id,
    name: "admins-can-map-specific-roles",
    description: "Admins can map or make composite role-a and role-b",
    decisionStrategy: "UNANIMOUS",
    roleIds: [
        roleA.id,
        roleB.id,
    ],
    scopes: [
        "map-role",
        "map-role-composite",
    ],
    policies: [adminsPolicy.id],
});
// Permission targeting ALL roles in the realm (role_ids omitted).
const adminsMapAnyRole = new keycloak.RoleAdminPermissions("admins_map_any_role", {
    realmId: realm.id,
    name: "admins-can-map-any-role",
    scopes: ["map-role"],
    policies: [adminsPolicy.id],
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    admin_permissions_enabled=True)
admin_permissions = keycloak.openid.get_client_output(realm_id=realm.id,
    client_id="admin-permissions")
role_a = keycloak.Role("role_a",
    realm_id=realm.id,
    name="role-a")
role_b = keycloak.Role("role_b",
    realm_id=realm.id,
    name="role-b")
admins = keycloak.Group("admins",
    realm_id=realm.id,
    name="admins")
admins_policy = keycloak.openid.ClientGroupPolicy("admins_policy",
    realm_id=realm.id,
    resource_server_id=admin_permissions.id,
    name="admins-policy",
    groups=[{
        "id": admins.id,
        "path": admins.path,
        "extend_children": False,
    }],
    logic="POSITIVE",
    decision_strategy="UNANIMOUS")
# Permission targeting two specific roles with multiple scopes.
admins_map_specific_roles = keycloak.RoleAdminPermissions("admins_map_specific_roles",
    realm_id=realm.id,
    name="admins-can-map-specific-roles",
    description="Admins can map or make composite role-a and role-b",
    decision_strategy="UNANIMOUS",
    role_ids=[
        role_a.id,
        role_b.id,
    ],
    scopes=[
        "map-role",
        "map-role-composite",
    ],
    policies=[admins_policy.id])
# Permission targeting ALL roles in the realm (role_ids omitted).
admins_map_any_role = keycloak.RoleAdminPermissions("admins_map_any_role",
    realm_id=realm.id,
    name="admins-can-map-any-role",
    scopes=["map-role"],
    policies=[admins_policy.id])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:                   pulumi.String("my-realm"),
			AdminPermissionsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		adminPermissions := openid.LookupClientOutput(ctx, openid.GetClientOutputArgs{
			RealmId:  realm.ID(),
			ClientId: pulumi.String("admin-permissions"),
		}, nil)
		roleA, err := keycloak.NewRole(ctx, "role_a", &keycloak.RoleArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("role-a"),
		})
		if err != nil {
			return err
		}
		roleB, err := keycloak.NewRole(ctx, "role_b", &keycloak.RoleArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("role-b"),
		})
		if err != nil {
			return err
		}
		admins, err := keycloak.NewGroup(ctx, "admins", &keycloak.GroupArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins"),
		})
		if err != nil {
			return err
		}
		adminsPolicy, err := openid.NewClientGroupPolicy(ctx, "admins_policy", &openid.ClientGroupPolicyArgs{
			RealmId: realm.ID(),
			ResourceServerId: pulumi.String(adminPermissions.ApplyT(func(adminPermissions openid.GetClientResult) (*string, error) {
				return adminPermissions.Id, nil
			}).(pulumi.StringPtrOutput)),
			Name: pulumi.String("admins-policy"),
			Groups: openid.ClientGroupPolicyGroupArray{
				&openid.ClientGroupPolicyGroupArgs{
					Id:             admins.ID(),
					Path:           admins.Path,
					ExtendChildren: pulumi.Bool(false),
				},
			},
			Logic:            pulumi.String("POSITIVE"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
		})
		if err != nil {
			return err
		}
		// Permission targeting two specific roles with multiple scopes.
		_, err = keycloak.NewRoleAdminPermissions(ctx, "admins_map_specific_roles", &keycloak.RoleAdminPermissionsArgs{
			RealmId:          realm.ID(),
			Name:             pulumi.String("admins-can-map-specific-roles"),
			Description:      pulumi.String("Admins can map or make composite role-a and role-b"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			RoleIds: pulumi.StringArray{
				roleA.ID(),
				roleB.ID(),
			},
			Scopes: pulumi.StringArray{
				pulumi.String("map-role"),
				pulumi.String("map-role-composite"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		// Permission targeting ALL roles in the realm (role_ids omitted).
		_, err = keycloak.NewRoleAdminPermissions(ctx, "admins_map_any_role", &keycloak.RoleAdminPermissionsArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins-can-map-any-role"),
			Scopes: pulumi.StringArray{
				pulumi.String("map-role"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        AdminPermissionsEnabled = true,
    });

    var adminPermissions = Keycloak.OpenId.GetClient.Invoke(new()
    {
        RealmId = realm.Id,
        ClientId = "admin-permissions",
    });

    var roleA = new Keycloak.Role("role_a", new()
    {
        RealmId = realm.Id,
        Name = "role-a",
    });

    var roleB = new Keycloak.Role("role_b", new()
    {
        RealmId = realm.Id,
        Name = "role-b",
    });

    var admins = new Keycloak.Group("admins", new()
    {
        RealmId = realm.Id,
        Name = "admins",
    });

    var adminsPolicy = new Keycloak.OpenId.ClientGroupPolicy("admins_policy", new()
    {
        RealmId = realm.Id,
        ResourceServerId = adminPermissions.Apply(getClientResult => getClientResult.Id),
        Name = "admins-policy",
        Groups = new[]
        {
            new Keycloak.OpenId.Inputs.ClientGroupPolicyGroupArgs
            {
                Id = admins.Id,
                Path = admins.Path,
                ExtendChildren = false,
            },
        },
        Logic = "POSITIVE",
        DecisionStrategy = "UNANIMOUS",
    });

    // Permission targeting two specific roles with multiple scopes.
    var adminsMapSpecificRoles = new Keycloak.RoleAdminPermissions("admins_map_specific_roles", new()
    {
        RealmId = realm.Id,
        Name = "admins-can-map-specific-roles",
        Description = "Admins can map or make composite role-a and role-b",
        DecisionStrategy = "UNANIMOUS",
        RoleIds = new[]
        {
            roleA.Id,
            roleB.Id,
        },
        Scopes = new[]
        {
            "map-role",
            "map-role-composite",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

    // Permission targeting ALL roles in the realm (role_ids omitted).
    var adminsMapAnyRole = new Keycloak.RoleAdminPermissions("admins_map_any_role", new()
    {
        RealmId = realm.Id,
        Name = "admins-can-map-any-role",
        Scopes = new[]
        {
            "map-role",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.OpenidFunctions;
import com.pulumi.keycloak.openid.inputs.GetClientArgs;
import com.pulumi.keycloak.Role;
import com.pulumi.keycloak.RoleArgs;
import com.pulumi.keycloak.Group;
import com.pulumi.keycloak.GroupArgs;
import com.pulumi.keycloak.openid.ClientGroupPolicy;
import com.pulumi.keycloak.openid.ClientGroupPolicyArgs;
import com.pulumi.keycloak.openid.inputs.ClientGroupPolicyGroupArgs;
import com.pulumi.keycloak.RoleAdminPermissions;
import com.pulumi.keycloak.RoleAdminPermissionsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .adminPermissionsEnabled(true)
            .build());

        final var adminPermissions = OpenidFunctions.getClient(GetClientArgs.builder()
            .realmId(realm.id())
            .clientId("admin-permissions")
            .build());

        var roleA = new Role("roleA", RoleArgs.builder()
            .realmId(realm.id())
            .name("role-a")
            .build());

        var roleB = new Role("roleB", RoleArgs.builder()
            .realmId(realm.id())
            .name("role-b")
            .build());

        var admins = new Group("admins", GroupArgs.builder()
            .realmId(realm.id())
            .name("admins")
            .build());

        var adminsPolicy = new ClientGroupPolicy("adminsPolicy", ClientGroupPolicyArgs.builder()
            .realmId(realm.id())
            .resourceServerId(adminPermissions.applyValue(_adminPermissions -> _adminPermissions.id()))
            .name("admins-policy")
            .groups(ClientGroupPolicyGroupArgs.builder()
                .id(admins.id())
                .path(admins.path())
                .extendChildren(false)
                .build())
            .logic("POSITIVE")
            .decisionStrategy("UNANIMOUS")
            .build());

        // Permission targeting two specific roles with multiple scopes.
        var adminsMapSpecificRoles = new RoleAdminPermissions("adminsMapSpecificRoles", RoleAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-can-map-specific-roles")
            .description("Admins can map or make composite role-a and role-b")
            .decisionStrategy("UNANIMOUS")
            .roleIds(            
                roleA.id(),
                roleB.id())
            .scopes(            
                "map-role",
                "map-role-composite")
            .policies(adminsPolicy.id())
            .build());

        // Permission targeting ALL roles in the realm (role_ids omitted).
        var adminsMapAnyRole = new RoleAdminPermissions("adminsMapAnyRole", RoleAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-can-map-any-role")
            .scopes("map-role")
            .policies(adminsPolicy.id())
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      adminPermissionsEnabled: true
  roleA:
    type: keycloak:Role
    name: role_a
    properties:
      realmId: ${realm.id}
      name: role-a
  roleB:
    type: keycloak:Role
    name: role_b
    properties:
      realmId: ${realm.id}
      name: role-b
  admins:
    type: keycloak:Group
    properties:
      realmId: ${realm.id}
      name: admins
  adminsPolicy:
    type: keycloak:openid:ClientGroupPolicy
    name: admins_policy
    properties:
      realmId: ${realm.id}
      resourceServerId: ${adminPermissions.id}
      name: admins-policy
      groups:
        - id: ${admins.id}
          path: ${admins.path}
          extendChildren: false
      logic: POSITIVE
      decisionStrategy: UNANIMOUS
  # Permission targeting two specific roles with multiple scopes.
  adminsMapSpecificRoles:
    type: keycloak:RoleAdminPermissions
    name: admins_map_specific_roles
    properties:
      realmId: ${realm.id}
      name: admins-can-map-specific-roles
      description: Admins can map or make composite role-a and role-b
      decisionStrategy: UNANIMOUS
      roleIds:
        - ${roleA.id}
        - ${roleB.id}
      scopes:
        - map-role
        - map-role-composite
      policies:
        - ${adminsPolicy.id}
  # Permission targeting ALL roles in the realm (role_ids omitted).
  adminsMapAnyRole:
    type: keycloak:RoleAdminPermissions
    name: admins_map_any_role
    properties:
      realmId: ${realm.id}
      name: admins-can-map-any-role
      scopes:
        - map-role
      policies:
        - ${adminsPolicy.id}
variables:
  adminPermissions:
    fn::invoke:
      function: keycloak:openid:getClient
      arguments:
        realmId: ${realm.id}
        clientId: admin-permissions

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

data "keycloak_openid_getclient" "adminPermissions" {
  realm_id  = keycloak_realm.realm.id
  client_id = "admin-permissions"
}

resource "keycloak_realm" "realm" {
  realm                     = "my-realm"
  admin_permissions_enabled = true
}
resource "keycloak_role" "role_a" {
  realm_id = keycloak_realm.realm.id
  name     = "role-a"
}
resource "keycloak_role" "role_b" {
  realm_id = keycloak_realm.realm.id
  name     = "role-b"
}
resource "keycloak_group" "admins" {
  realm_id = keycloak_realm.realm.id
  name     = "admins"
}
resource "keycloak_openid_clientgrouppolicy" "admins_policy" {
  realm_id           = keycloak_realm.realm.id
  resource_server_id = data.keycloak_openid_getclient.adminPermissions.id
  name               = "admins-policy"
  groups {
    id              = keycloak_group.admins.id
    path            = keycloak_group.admins.path
    extend_children = false
  }
  logic             = "POSITIVE"
  decision_strategy = "UNANIMOUS"
}
# Permission targeting two specific roles with multiple scopes.
resource "keycloak_roleadminpermissions" "admins_map_specific_roles" {
  realm_id          = keycloak_realm.realm.id
  name              = "admins-can-map-specific-roles"
  description       = "Admins can map or make composite role-a and role-b"
  decision_strategy = "UNANIMOUS"
  role_ids          = [keycloak_role.role_a.id, keycloak_role.role_b.id]
  scopes            = ["map-role", "map-role-composite"]
  policies          = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}
# Permission targeting ALL roles in the realm (role_ids omitted).
resource "keycloak_roleadminpermissions" "admins_map_any_role" {
  realm_id = keycloak_realm.realm.id
  name     = "admins-can-map-any-role"
  scopes   = ["map-role"]
  policies = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}

    Create RoleAdminPermissions Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RoleAdminPermissions(name: string, args: RoleAdminPermissionsArgs, opts?: CustomResourceOptions);
    @overload
def RoleAdminPermissions(resource_name: str,
                         args: RoleAdminPermissionsArgs,
                         opts: Optional[ResourceOptions] = None)

@overload
def RoleAdminPermissions(resource_name: str,
                         opts: Optional[ResourceOptions] = None,
                         realm_id: Optional[str] = None,
                         scopes: Optional[Sequence[str]] = None,
                         decision_strategy: Optional[str] = None,
                         description: Optional[str] = None,
                         name: Optional[str] = None,
                         policies: Optional[Sequence[str]] = None,
                         role_ids: Optional[Sequence[str]] = None)
    func NewRoleAdminPermissions(ctx *Context, name string, args RoleAdminPermissionsArgs, opts ...ResourceOption) (*RoleAdminPermissions, error)
    public RoleAdminPermissions(string name, RoleAdminPermissionsArgs args, CustomResourceOptions? opts = null)
    public RoleAdminPermissions(String name, RoleAdminPermissionsArgs args)
public RoleAdminPermissions(String name, RoleAdminPermissionsArgs args, CustomResourceOptions options)

    type: keycloak:RoleAdminPermissions
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "keycloak_role_admin_permissions" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args RoleAdminPermissionsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RoleAdminPermissionsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RoleAdminPermissionsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RoleAdminPermissionsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RoleAdminPermissionsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var roleAdminPermissionsResource = new Keycloak.RoleAdminPermissions("roleAdminPermissionsResource", new()
{
    RealmId = "string",
    Scopes = new[]
    {
        "string",
    },
    DecisionStrategy = "string",
    Description = "string",
    Name = "string",
    Policies = new[]
    {
        "string",
    },
    RoleIds = new[]
    {
        "string",
    },
});

    example, err := keycloak.NewRoleAdminPermissions(ctx, "roleAdminPermissionsResource", &keycloak.RoleAdminPermissionsArgs{
	RealmId: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DecisionStrategy: pulumi.String("string"),
	Description:      pulumi.String("string"),
	Name:             pulumi.String("string"),
	Policies: pulumi.StringArray{
		pulumi.String("string"),
	},
	RoleIds: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "keycloak_role_admin_permissions" "roleAdminPermissionsResource" {
  lifecycle {
    create_before_destroy = true
  }
  realm_id          = "string"
  scopes            = ["string"]
  decision_strategy = "string"
  description       = "string"
  name              = "string"
  policies          = ["string"]
  role_ids          = ["string"]
}

    var roleAdminPermissionsResource = new RoleAdminPermissions("roleAdminPermissionsResource", RoleAdminPermissionsArgs.builder()
    .realmId("string")
    .scopes("string")
    .decisionStrategy("string")
    .description("string")
    .name("string")
    .policies("string")
    .roleIds("string")
    .build());

    role_admin_permissions_resource = keycloak.RoleAdminPermissions("roleAdminPermissionsResource",
    realm_id="string",
    scopes=["string"],
    decision_strategy="string",
    description="string",
    name="string",
    policies=["string"],
    role_ids=["string"])

    const roleAdminPermissionsResource = new keycloak.RoleAdminPermissions("roleAdminPermissionsResource", {
    realmId: "string",
    scopes: ["string"],
    decisionStrategy: "string",
    description: "string",
    name: "string",
    policies: ["string"],
    roleIds: ["string"],
});

    type: keycloak:RoleAdminPermissions
properties:
    decisionStrategy: string
    description: string
    name: string
    policies:
        - string
    realmId: string
    roleIds:
        - string
    scopes:
        - string

    RoleAdminPermissions Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The RoleAdminPermissions resource accepts the following input properties:

    RealmId string
    The realm in which to manage this permission.
    Scopes List<string>
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    Policies List<string>
    Set of policy IDs to attach to the permission.
    RoleIds List<string>
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    RealmId string
    The realm in which to manage this permission.
    Scopes []string
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    Policies []string
    Set of policy IDs to attach to the permission.
    RoleIds []string
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    realm_id string
    The realm in which to manage this permission.
    scopes list(string)
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    decision_strategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies list(string)
    Set of policy IDs to attach to the permission.
    role_ids list(string)
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies List<String>
    Set of policy IDs to attach to the permission.
    roleIds List<String>
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    realmId string
    The realm in which to manage this permission.
    scopes string[]
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    decisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies string[]
    Set of policy IDs to attach to the permission.
    roleIds string[]
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    realm_id str
    The realm in which to manage this permission.
    scopes Sequence[str]
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    decision_strategy str
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description str
    Description of the permission.
    name str
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies Sequence[str]
    Set of policy IDs to attach to the permission.
    role_ids Sequence[str]
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies List<String>
    Set of policy IDs to attach to the permission.
    roleIds List<String>
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RoleAdminPermissions resource produces the following output properties:

    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    Enabled bool
    Always true when the resource exists.
    Id string
    The provider-assigned unique ID for this managed resource.
    PermissionId string
    The internal Keycloak UUID of the permission.
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    Enabled bool
    Always true when the resource exists.
    Id string
    The provider-assigned unique ID for this managed resource.
    PermissionId string
    The internal Keycloak UUID of the permission.
    authorization_resource_server_id string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled bool
    Always true when the resource exists.
    id string
    The provider-assigned unique ID for this managed resource.
    permission_id string
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled Boolean
    Always true when the resource exists.
    id String
    The provider-assigned unique ID for this managed resource.
    permissionId String
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled boolean
    Always true when the resource exists.
    id string
    The provider-assigned unique ID for this managed resource.
    permissionId string
    The internal Keycloak UUID of the permission.
    authorization_resource_server_id str
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled bool
    Always true when the resource exists.
    id str
    The provider-assigned unique ID for this managed resource.
    permission_id str
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled Boolean
    Always true when the resource exists.
    id String
    The provider-assigned unique ID for this managed resource.
    permissionId String
    The internal Keycloak UUID of the permission.

    Look up Existing RoleAdminPermissions Resource

    Get an existing RoleAdminPermissions resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RoleAdminPermissionsState, opts?: CustomResourceOptions): RoleAdminPermissions
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        authorization_resource_server_id: Optional[str] = None,
        decision_strategy: Optional[str] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        name: Optional[str] = None,
        permission_id: Optional[str] = None,
        policies: Optional[Sequence[str]] = None,
        realm_id: Optional[str] = None,
        role_ids: Optional[Sequence[str]] = None,
        scopes: Optional[Sequence[str]] = None) -> RoleAdminPermissions
    func GetRoleAdminPermissions(ctx *Context, name string, id IDInput, state *RoleAdminPermissionsState, opts ...ResourceOption) (*RoleAdminPermissions, error)
    public static RoleAdminPermissions Get(string name, Input<string> id, RoleAdminPermissionsState? state, CustomResourceOptions? opts = null)
    public static RoleAdminPermissions get(String name, Output<String> id, RoleAdminPermissionsState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:RoleAdminPermissions    get:      id: ${id}
    import {
  to = keycloak_role_admin_permissions.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Enabled bool
    Always true when the resource exists.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    PermissionId string
    The internal Keycloak UUID of the permission.
    Policies List<string>
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    RoleIds List<string>
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    Scopes List<string>
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Enabled bool
    Always true when the resource exists.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    PermissionId string
    The internal Keycloak UUID of the permission.
    Policies []string
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    RoleIds []string
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    Scopes []string
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    authorization_resource_server_id string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decision_strategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    enabled bool
    Always true when the resource exists.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permission_id string
    The internal Keycloak UUID of the permission.
    policies list(string)
    Set of policy IDs to attach to the permission.
    realm_id string
    The realm in which to manage this permission.
    role_ids list(string)
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    scopes list(string)
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    enabled Boolean
    Always true when the resource exists.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId String
    The internal Keycloak UUID of the permission.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    roleIds List<String>
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    scopes List<String>
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    authorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    enabled boolean
    Always true when the resource exists.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId string
    The internal Keycloak UUID of the permission.
    policies string[]
    Set of policy IDs to attach to the permission.
    realmId string
    The realm in which to manage this permission.
    roleIds string[]
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    scopes string[]
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    authorization_resource_server_id str
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decision_strategy str
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description str
    Description of the permission.
    enabled bool
    Always true when the resource exists.
    name str
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permission_id str
    The internal Keycloak UUID of the permission.
    policies Sequence[str]
    Set of policy IDs to attach to the permission.
    realm_id str
    The realm in which to manage this permission.
    role_ids Sequence[str]
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    scopes Sequence[str]
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    enabled Boolean
    Always true when the resource exists.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId String
    The internal Keycloak UUID of the permission.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    roleIds List<String>
    Set of role UUIDs (keycloak_role.xxx.id) this permission applies to. When omitted or empty, the permission applies to all roles in the realm.
    scopes List<String>
    Set of scopes this permission grants. Valid values: map-role, map-role-client-scope, map-role-composite.

    Import

    Role admin permissions can be imported using {{realmId}}/{{permissionId}}:

    $ pulumi import keycloak:index/roleAdminPermissions:RoleAdminPermissions example my-realm/permission-uuid

    After import, run pulumi up to reconcile roleIds, scopes, and policies with your configuration.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo keycloak logo
    Viewing docs for Keycloak v6.13.0
    published on Saturday, Aug 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial