---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "infisical_project_role Resource - terraform-provider-infisical"
subcategory: "Projects"
description: |-
  Create custom project roles & save to Infisical. Only Machine Identity authentication is supported for this resource.
---

# infisical_project_role (Resource)

Create custom project roles & save to Infisical. Only Machine Identity authentication is supported for this resource.

## Example Usage

```terraform
terraform {
  required_providers {
    infisical = {
      # version = <latest version>
      source = "infisical/infisical"
    }
  }
}

provider "infisical" {
  host = "https://app.infisical.com" # Only required if using self hosted instance of Infisical, default is https://app.infisical.com
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}

resource "infisical_project" "example" {
  name = "example"
  slug = "example"
}

resource "infisical_project_role" "biller" {
  project_slug = infisical_project.example.slug
  name         = "Tester"
  description  = "A test role"
  slug         = "tester"
  permissions_v2 = [
    {
      subject = "integrations"
      action  = ["read", "create"]
    },
    {
      subject = "secrets"
      action  = ["describeSecret", "readValue", "edit"]
      conditions = jsonencode({
        environment = {
          "$eq" = "dev"
        }
        secretPath = {
          "$eq" = "/"
        }
      })
    },
  ]
}

resource "infisical_project_role" "viewer" {
  project_id  = infisical_project.example.id
  name        = "Viewer"
  description = "A viewer role"
  slug        = "viewer"
  permissions_v2 = [
    {
      subject = "secrets"
      action  = ["describeSecret", "readValue"]
    },
  ]
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `name` (String) The name for the new role
- `slug` (String) The slug for the new role

### Optional

- `description` (String) The description for the new role. Defaults to an empty string.
- `permissions` (Attributes List) (DEPRECATED, USE permissions_v2. Refer to the migration guide in https://infisical.com/docs/internals/permissions#migrating-from-permission-v1-to-permission-v2) The permissions assigned to the project role (see [below for nested schema](#nestedatt--permissions))
- `permissions_v2` (Attributes List) The permissions assigned to the project role. Refer to the documentation here https://infisical.com/docs/internals/permissions/project-permissions for its usage. (see [below for nested schema](#nestedatt--permissions_v2))
- `project_id` (String) The ID of the project to create role. Must provide either project_id or project_slug, but not both.
- `project_slug` (String) The slug of the project to create role. Must provide either project_slug or project_id, but not both.

### Read-Only

- `id` (String) The ID of the role

<a id="nestedatt--permissions"></a>
### Nested Schema for `permissions`

Required:

- `action` (String) Describe what action an entity can take. Enum: create,edit,delete,read
- `subject` (String) Describe what action an entity can take. Enum: role,member,groups,settings,integrations,webhooks,service-tokens,environments,tags,audit-logs,ip-allowlist,workspace,secrets,secret-rollback,secret-approval,secret-rotation,secret-validation-rules,identity,certificate-authorities,certificates,certificate-policies,kms,pki-alerts,pki-collections

Optional:

- `conditions` (Attributes) The conditions to scope permissions (see [below for nested schema](#nestedatt--permissions--conditions))

<a id="nestedatt--permissions--conditions"></a>
### Nested Schema for `permissions.conditions`

Optional:

- `environment` (String) The environment slug this permission should allow.
- `secret_path` (String) The secret path this permission should be scoped to



<a id="nestedatt--permissions_v2"></a>
### Nested Schema for `permissions_v2`

Required:

- `action` (Set of String) Describe what actions an entity can take.
- `subject` (String) Describe the entity the permission pertains to.

Optional:

- `conditions` (String) When specified, only matching conditions will be allowed to access given resource. Refer to the documentation in https://infisical.com/docs/internals/permissions#conditions for the complete list of supported properties and operators.
- `inverted` (Boolean) Whether rule forbids. Set this to true if permission forbids.

## Import

Import is supported using the following syntax:

```shell
# This will import the project role by its ID
terraform import infisical_project_role.example <role_id>
```