---
page_title: "ona_runner_role_assignment Resource - ona"
subcategory: "Identity and Access"
description: |-
  Ona role assignment granting a group access to one runner.
---

# ona_runner_role_assignment (Resource)

Ona role assignment granting a group access to one runner.

Use this resource to manage one group's direct access to one runner. The supported roles are:

- `user`: view and use the runner.
- `admin`: fully control the runner, including its sharing settings.

Changing the runner, group, or role replaces the assignment. Import existing access before adding it to the configuration so Terraform does not try to create a duplicate.

Sharing with a custom group requires the Enterprise plan. Ona validates this requirement when it creates the assignment.

To manage General access for everyone in the organization, set `group_id` to the system-managed `org-members` group ID and use the `user` role:

```terraform
resource "ona_runner_role_assignment" "everyone" {
  runner_id = var.runner_id
  group_id   = var.org_members_group_id
  role       = "user"
}
```

The provider does not currently discover the `org-members` group, so supply its ID from your existing organization inventory.

For product context, see [Share a runner](https://ona.com/docs/ona/organizations/sharing-resources#share-a-runner) and [Manage groups](https://ona.com/docs/ona/organizations/groups).

## Example Usage

```terraform
variable "runner_id" {
  type        = string
  description = "ID of an existing Ona runner."
}

resource "ona_group" "runner_admins" {
  name        = "Runner Admins"
  description = "People allowed to configure and share the runner."
}

resource "ona_runner_role_assignment" "admins" {
  runner_id = var.runner_id
  group_id  = ona_group.runner_admins.id
  role      = "admin"
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `group_id` (String) Group ID receiving access to the runner. Changing this value replaces the assignment.
- `role` (String) Runner role. Supported values are `user` and `admin`. Changing this value replaces the assignment.
- `runner_id` (String) Runner ID receiving the group access. Changing this value replaces the assignment.

### Read-Only

- `id` (String) Role assignment ID.

## Import

Import identifies an assignment by `<runner_id>/<group_id>`. Terraform reads the current role from Ona.

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env sh

terraform import ona_runner_role_assignment.admins eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee/22222222-2222-4222-8222-222222222222
```