Access Management

ImageFactory uses Role-Based Access Control (RBAC) to manage permissions. You can define custom roles, bind them to users or API keys, and manage API keys themselves using Terraform.

Roles

The imagefactory_role resource defines a set of permissions.

resource "imagefactory_role" "template_admin" {
  name        = "Template Admin"
  description = "Full access to manage templates and components"

  rules {
    resources = ["TEMPLATE", "COMPONENT"]
    actions   = ["CREATE", "READ", "UPDATE", "DELETE"]
  }
}

Argument Reference

Argument	Type	Required/Optional	Description
name	String	Required	Unique name for the role.
description	String	Optional	A brief description of the role.
rules	Block List	Required	Permissions granted by this role.
rules.resources	List	Required	Resources: TEMPLATE, COMPONENT, ACCOUNT, ROLE, API_KEY, VARIABLE.
rules.actions	List	Required	Actions: ANY, CREATE, READ, UPDATE, DELETE, VIEW.

Import

terraform import imagefactory_role.main <ROLE_ID>

Role Bindings

The imagefactory_role_binding resource assigns a role to a subject (a user or an API key).

# Bind a role to a user
resource "imagefactory_role_binding" "user_binding" {
  kind       = "USER"
  role_id    = imagefactory_role.template_admin.id
  subject    = "user@example.com"
}

# Bind a role to an API key
resource "imagefactory_role_binding" "api_key_binding" {
  kind       = "API_KEY"
  role_id    = data.imagefactory_role.admin.id
  subject    = imagefactory_api_key.ci_cd.id
}

Argument Reference

Argument	Type	Required/Optional	Description
kind	String	Required	Type of subject: USER or API_KEY.
role_id	String	Required	The ID of the role to bind.
subject	String	Required	The email address (for USER) or the API Key ID (for API_KEY).

Import

terraform import imagefactory_role_binding.main <ROLE_BINDING_ID>

API Keys

The imagefactory_api_key resource manages API keys for programmatic access.

resource "imagefactory_api_key" "ci_cd" {
  name       = "ci-cd-pipeline"
  expires_at = "2026-12-31"
}

note

The API key secret is only returned once, during the creation of the resource. If you lose it, you must recreate the key. An API key alone does not grant any permissions — you must create an imagefactory_role_binding and assign an access role to it.

Argument Reference

Argument	Type	Required/Optional	Description
name	String	Required	Unique name for the API key.
expires_at	String	Optional	Expiration date in YYYY-MM-DD format (e.g., 2026-12-31).

Import

terraform import imagefactory_api_key.main <API_KEY_ID>