--- schema_version: "1" id: 4b449dcd944f53a785293bbdd7cca4be7b8bf8246d93aa966ed5a821d63a0289 title: Access Management Resources collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mulesoft-terraform-provider/access-management-resources.md canonical_url: https://docs.mulesoft.com/mulesoft-terraform-provider/access-management-resources source_site: docs.mulesoft.com content_type: documentation content_hash: 6805a9c00c3387f981c605dc55384814ee2493b6873f2ebb50dcfecd77d83f38 description: MuleSoft Documentation Site latest: true --- --- product: MuleSoft Terraform Provider --- # Access Management Resources > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Access Management resources to manage organizations, environments, connected applications, scopes, and teams in Anypoint Platform. Access Management resources require administrative privileges and use the `anypoint.admin` provider configuration for authentication. ## `anypoint_connected_app_scopes` Use the `anypoint_connected_app_scopes` resource to manage scopes for a connected application in Anypoint Platform. > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_connected_app_scopes" "example" { provider = anypoint.admin connected_app_id = "my-connected-app-id" scopes = [ { scope = "admin:cloudhub" context_params = { org = "your-org-id" } }, { scope = "read:applications" context_params = { org = "your-org-id" envId = "your-env-id" } } ] } ``` ### Required Arguments - `connected_app_id` - The ID of the connected application to manage scopes for. - `scopes` - (Block Set) The set of scopes to assign to the connected application. See [Nested Schema for `scopes`](#nested-schema-for-scopes). ### Read-Only Attributes - `id` - The unique identifier for the connected app scopes (same as `connected_app_id`). ### Nested Schema for `scopes` - `scope` - (Required) The scope name (for example, `admin:cloudhub`, `read:applications`). - `context_params` - (Map of String) Context parameters for the scope (for example, organization ID). ### Import An existing connected app’s scopes can be imported using the connected app ID (UUID). #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_connected_app_scopes.imported id = "" } resource "anypoint_connected_app_scopes" "imported" { provider = anypoint.admin connected_app_id = "" scopes = [] } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_connected_app_scopes.imported ``` ## `anypoint_environment` Use the `anypoint_environment` resource to manage Anypoint Platform environments. > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_environment" "example" { provider = anypoint.admin name = "my-sandbox-env" type = "sandbox" is_production = false organization_id = "your-org-id" } ``` ### Required Arguments - `name` - The name of the environment. ### Optional Arguments - `organization_id` - Organization ID where the environment will be created. If not provided, the organization ID is inferred from the connected app credentials. - `type` - The type of the environment (`design`, `sandbox`, `production`). Defaults to `sandbox`. - `is_production` - Whether this is a production environment. Defaults to `false`. - `arc_namespace` - The ARC namespace for the environment. - `client_id` - The client ID associated with the environment. ### Read-Only Attributes - `id` - The unique identifier for the environment. ### Import An existing environment can be imported using its environment ID (UUID). #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_environment.imported id = "" } resource "anypoint_environment" "imported" { provider = anypoint.admin organization_id = "" name = "" type = "sandbox" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_environment.imported ``` ## `anypoint_organization` Use the `anypoint_organization` resource to create and manage Anypoint Platform organizations (business groups). > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Entitlement State Behaviour The provider honours user-defined state for entitlements, not platform defaults. - Fields you declare are managed by Terraform — any platform-side change will be reverted on the next `apply`. - Fields you omit are unmanaged. Platform-side updates to those fields aren’t reflected in the plan and won’t be reverted. - Master-org-only entitlements (`hybrid`, `omni_gateway`, `service_mesh`, `worker_logging_override`, `runtime_fabric`, `design_center`) are inherited on sub-orgs and can’t be set via this resource on a business group. They are stripped from API requests to prevent HTTP 403 errors. Only declare entitlement fields you want Terraform to own. Leave everything else out of your config. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_organization" "example" { provider = anypoint.admin name = "my-sub-org" parent_organization_id = "parent-org-id" owner_id = "owner-user-id" entitlements = { create_sub_orgs = false create_environments = true global_deployment = false vcores_production = { assigned = 0 } vcores_sandbox = { assigned = 0 } vcores_design = { assigned = 0 } vpcs = { assigned = 0 } network_connections = { assigned = 0 } managed_gateway_small = { assigned = 0 } managed_gateway_large = { assigned = 0 } } } ``` ### Required Arguments - `name` - The name of the organization. - `owner_id` - The ID of the organization owner. Changing this forces a new resource. - `parent_organization_id` - The ID of the parent organization. Changing this forces a new resource. ### Optional Arguments - `entitlements` - (Block) Entitlements for the organization. Only declared fields are managed by Terraform. See [Nested Schema for `entitlements`](#nested-schema-for-entitlements). ### Read-Only Attributes - `id` - The unique identifier for the organization. - `client_id` - The client ID associated with the organization. - `created_at` - The creation timestamp of the organization. - `deleted_at` - The deletion timestamp of the organization. - `domain` - The domain of the organization. - `environments` - (Block List) The environments within the organization.. - `gdot_id` - The GDOT ID of the organization. - `idprovider_id` - The ID provider ID for the organization. - `is_automatic_admin_promotion_exempt` - Whether the organization is exempt from automatic admin promotion. - `is_federated` - Whether the organization is federated. - `is_master` - Whether the organization is a master organization. - `is_root` - Whether the organization is a root organization. - `mfa_required` - Whether MFA is required for the organization. - `org_type` - The type of the organization. - `parent_organization_ids` - List of parent organization IDs (ancestor chain). - `session_timeout` - The session timeout for the organization. - `sub_organization_ids` - List of sub-organization IDs. - `subscription` - (Block) The subscription details for the organization.. - `tenant_organization_ids` - List of tenant organization IDs. - `updated_at` - The last update timestamp of the organization. ### Nested Schema for `entitlements` Only the fields you declare are managed by Terraform. Fields you omit aren’t tracked and won’t be reverted if the platform changes them. - `create_environments` - Whether environments can be created. Defaults to `false`. - `create_sub_orgs` - Whether sub-organizations can be created. Defaults to `false`. - `global_deployment` - Whether global deployment is enabled. Defaults to `false`. - `runtime_fabric` - Whether Runtime Fabric is enabled. **Master-org-only** — ignored on business groups. - `design_center` - (Block) Design Center entitlement. **Master-org-only** — ignored on business groups. - `api` - Whether API Designer is enabled. - `mozart` - Whether Flow Designer (Mozart) is enabled. - `omni_gateway` - (Block) Omni Gateway entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `hybrid` - (Block) Hybrid entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `service_mesh` - (Block) Service Mesh entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `worker_logging_override` - (Block) Worker logging override entitlement. **Master-org-only** — ignored on business groups. - `enabled` - Whether this feature is enabled. - `vcores_production` - (Block) Production vCore entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `vcores_sandbox` - (Block) Sandbox vCore entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `vcores_design` - (Block) Design vCore entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `vpcs` - (Block) VPC entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `network_connections` - (Block) Network connections entitlement. - `assigned` - Number of assigned units. Defaults to `0`. - `reassigned` - Number of reassigned units. Defaults to `0`. - `gateways` - (Block) Gateways entitlement. - `assigned` - Number of assigned units. - `load_balancer` - (Block) Load balancer entitlement. - `assigned` - Number of assigned units. - `managed_gateway_small` - (Block) Managed Gateway (small) entitlement. - `assigned` - Number of assigned units. - `managed_gateway_large` - (Block) Managed Gateway (large) entitlement. - `assigned` - Number of assigned units. - `mq_messages` - (Block) MQ messages entitlement. - `base` - Base number of MQ units. Defaults to `0`. - `add_on` - Add-on number of MQ units. Defaults to `0`. - `mq_requests` - (Block) MQ requests entitlement. - `base` - Base number of MQ units. Defaults to `0`. - `add_on` - Add-on number of MQ units. Defaults to `0`. > [!NOTE] `static_ips` and `vpns` entitlements are managed server-side by Anypoint and aren’t > settable via Terraform. Configure them through the Anypoint UI or API. ### Nested Schema for `environments` > [!NOTE] When a new organization is created, Anypoint Platform automatically provisions two > environments: Sandbox and Production. These appear in the `environments` read-only attribute after > the first apply and don’t need to be declared in your configuration. - `id` - The environment ID. _(Read-Only)_ - `name` - The environment name. _(Read-Only)_ - `organization_id` - The organization ID. _(Read-Only)_ - `client_id` - The environment client ID. _(Read-Only)_ - `type` - The environment type. _(Read-Only)_ - `is_production` - Whether the environment is a production environment. _(Read-Only)_ - `arc_namespace` - The ARC namespace of the environment. _(Optional)_ ### Nested Schema for `subscription` - `category` - The subscription category. _(Read-Only)_ - `type` - The subscription type. _(Read-Only)_ - `expiration` - The subscription expiration date. _(Read-Only)_ - `justification` - The subscription justification. _(Optional)_ ### Import An existing organization can be imported using its organization ID (UUID). Your HCL must declare `name`, `parent_organization_id`, and `owner_id` before importing — those are required attributes. The first `terraform plan` after import refreshes all read-only and optional attributes (including entitlements) from the Anypoint API. `parent_organization_id` is derived from the server-returned ancestor chain (`parent_organization_ids`) on the first refresh. If the derivation doesn’t match what you wrote in HCL, update the HCL to match — changing `parent_organization_id` triggers a destroy+recreate. #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_organization.imported id = "" } resource "anypoint_organization" "imported" { provider = anypoint.admin name = "" parent_organization_id = "" owner_id = "" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_organization.imported ``` ## `anypoint_team` Use the `anypoint_team` resource to manage teams in Anypoint Platform. > [!NOTE] **Admin provider required:** This is an Access Management resource. It requires the > `anypoint.admin` provider configured with `auth_type = "user"` (user credentials + connected app > client credentials). A standard connected app (client credentials only) doesn’t have sufficient > privileges for Access Management operations. ### Example Usage ```hcl # Admin provider – authenticates on behalf of a user using connected app credentials provider "anypoint" { alias = "admin" auth_type = "user" client_id = var.anypoint_admin_client_id client_secret = var.anypoint_admin_client_secret username = var.anypoint_admin_username password = var.anypoint_admin_password base_url = var.anypoint_base_url } resource "anypoint_team" "example" { provider = anypoint.admin team_name = "Development Team" parent_team_id = "root-team-id" team_type = "internal" } resource "anypoint_team" "sub_team" { provider = anypoint.admin team_name = "Frontend Team" parent_team_id = anypoint_team.example.id team_type = "internal" } ``` ### Required Arguments - `team_name` - The name of the team. - `parent_team_id` - The ID of the parent team. - `team_type` - The type of the team. ### Optional Arguments - `organization_id` - Organization ID where the team will be created. If not provided, the organization ID is inferred from the connected app credentials. ### Read-Only Attributes - `id` - The unique identifier for the team. - `created_at` - The timestamp when the team was created. - `updated_at` - The timestamp when the team was last updated. ### Import An existing team can be imported using its team ID (UUID). #### Using an import block (Terraform ≥ 1.5 — recommended) ```hcl import { provider = anypoint.admin to = anypoint_team.imported id = "" } resource "anypoint_team" "imported" { provider = anypoint.admin organization_id = "" team_name = "" team_type = "internal" } ``` After adding the import block, run: ```shell # Let Terraform generate the full resource configuration automatically: terraform plan -generate-config-out=generated.tf # Or apply the import directly if you have an existing resource block: terraform apply ``` #### Using the CLI (deprecated, Terraform < 1.5) ```shell terraform import anypoint_team.imported ```