Groups

A Group is a named collection of Users within a Zone. Groups let you grant access to a set of Users at once: assign a Role to a Group and every member inherits it, or name the Group in a policy instead of enumerating each User.

Groups are created and managed by an Admin. See Groups for the Console steps.

Every Group has a display name and an identifier that is unique within the Zone. The identifier is what policy rules match on, so it is the stable reference for a Group. Both can be changed at any time.

A User can belong to any number of Groups. Groups cannot be nested: only Users can belong to Groups.

A Group can be assigned organization Roles and custom Zone Roles. Every member of the Group inherits them, and a User’s effective Roles are the union of the Roles assigned to them directly and the Roles assigned to every Group they belong to. Removing a User from a Group removes the Roles they were assigned through it.

Group membership is a first-class entity in policy evaluation. A Cedar rule matches a Group with the in operator:

permit (
  principal in Keycard::Group::"data-analysts",
  action,
  resource
);

See Group-based policies for the full policy reference and more examples.