---
page_title: "ona_project_role_assignment Resource - ona"
subcategory: "Identity and Access"
description: |-
  Ona role assignment granting a group access to one project.
---

# ona_project_role_assignment (Resource)

Ona role assignment granting a group access to one project.

Use this resource to manage one group's direct access to one project. The supported roles are:

- `user`: view and use the project.
- `editor`: modify the project configuration.
- `admin`: fully control the project, including its sharing settings.

Changing the project, group, or role replaces the assignment. Import existing access before adding it to the configuration so Terraform does not try to create a duplicate.

Sharing with a custom group requires the Enterprise plan. The group must also be able to use at least one runner available to the project. Ona validates these requirements when it creates the assignment.

To manage General access for everyone in the organization, set `group_id` to the system-managed `org-members` group ID and use the `user` role:

```terraform
resource "ona_project_role_assignment" "everyone" {
  project_id = var.project_id
  group_id   = var.org_members_group_id
  role       = "user"
}
```

The provider does not currently discover the `org-members` group, so supply its ID from your existing organization inventory.

For product context, see [Share a project](https://ona.com/docs/ona/projects/project-sharing) and [Manage groups](https://ona.com/docs/ona/organizations/groups).

## Example Usage

```terraform
variable "project_id" {
  type        = string
  description = "ID of an existing Ona project."
}

resource "ona_group" "project_editors" {
  name        = "Project Editors"
  description = "People allowed to edit the project configuration."
}

resource "ona_project_role_assignment" "editors" {
  project_id = var.project_id
  group_id   = ona_group.project_editors.id
  role       = "editor"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `group_id` (String) Group ID receiving access to the project. Changing this value replaces the assignment.
- `project_id` (String) Project ID receiving the group access. Changing this value replaces the assignment.
- `role` (String) Project role. Supported values are `user`, `editor`, and `admin`. Changing this value replaces the assignment.

### Read-Only

- `id` (String) Role assignment ID.

## Import

Import identifies an assignment by `<project_id>/<group_id>`. Terraform reads the current role from Ona.

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env sh

terraform import ona_project_role_assignment.editors eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee/22222222-2222-4222-8222-222222222222
```