Cloudflare.Iam reference

ResourceGroup

Source: src/Cloudflare/Iam/ResourceGroup.ts

A Cloudflare IAM resource group — a named set of account resources (zones, or the whole account) that fine-grained policies attach to.

Resource groups pair with permission groups inside a user group policy: the permission group says what actions are allowed, the resource group says which resources they apply to. Both name and scope are mutable in place.

Account-scoped IAM (resource groups, user groups) is an Enterprise feature.

ResourceGroup: Creating a Resource Group

Scope a group to the whole account

const { accountId } = yield* yield* Cloudflare.CloudflareEnvironment;
const group = yield* Cloudflare.Iam.ResourceGroup("AllResources", {
  scope: {
    key: `com.cloudflare.api.account.${accountId}`,
    objects: [{ key: "*" }],
  },
});

Scope a group to a single zone

const group = yield* Cloudflare.Iam.ResourceGroup("ZoneOnly", {
  name: "my-zone-resources",
  scope: {
    key: `com.cloudflare.api.account.${accountId}`,
    objects: [
      { key: `com.cloudflare.api.account.zone.${zone.zoneId}` },
    ],
  },
});

ResourceGroup: Using with User Groups

yield* Cloudflare.Iam.UserGroup("Readers", {
  policies: [
    {
      access: "allow",
      permissionGroups: [readOnlyPermissionGroupId],
      resourceGroups: [group.resourceGroupId],
    },
  ],
});

UserGroup

Source: src/Cloudflare/Iam/UserGroup.ts

A Cloudflare IAM user group — a named set of account members that share fine-grained policies (permission groups scoped to resource groups).

Both name and policies are mutable in place; updating policies replaces the full set. Add members with UserGroupMembership.

Account-scoped IAM (resource groups, user groups) is an Enterprise feature.

UserGroup: Creating a User Group

Empty group

const group = yield* Cloudflare.Iam.UserGroup("Operators", {});

Group with a policy

const readers = yield* Cloudflare.Iam.UserGroup("Readers", {
  name: "zone-readers",
  policies: [
    {
      access: "allow",
      permissionGroups: [readOnlyPermissionGroupId],
      resourceGroups: [resourceGroup.resourceGroupId],
    },
  ],
});

UserGroup: Managing Members

yield* Cloudflare.Iam.UserGroupMembership("SamInReaders", {
  userGroup: readers.userGroupId,
  memberId: accountMember.memberId,
});

UserGroupMembership

Source: src/Cloudflare/Iam/UserGroupMembership.ts

Membership of a single account member in a Cloudflare IAM user group.

This is an existence-only resource: it has no mutable aspects beyond its identity (user group + member), so changing either property triggers a replacement. Cloudflare’s member-add API is idempotent — adding a member who is already in the group succeeds — so reconcile is a simple observe-then-ensure flow.

Account-scoped IAM (user groups and their members) is an Enterprise feature.

UserGroupMembership: Adding a Member

const group = yield* Cloudflare.Iam.UserGroup("Operators", {});

yield* Cloudflare.Iam.UserGroupMembership("SamInOperators", {
  userGroup: group.userGroupId,
  memberId: "b67b4c279ea0177a0ddff0a2ef64b11b",
});