Understand groups

A group is a collection of identities that you can use as a single subject when managing access in STACKIT IAM. Groups help you grant access to multiple users and service accounts through one role binding instead of assigning the same role to each identity individually.

Groups can contain users, other groups, and service accounts. When a role is bound to a group, its members inherit the permissions granted by that role. Membership is transitive: members of a nested group also inherit access granted to the parent group.

For background on Cloud Roles, permissions, and role bindings, see Understand roles and permissions and Assign roles to a user or service account.

Group types

Groups can be managed directly through STACKIT IAM or provisioned from an external identity provider using SCIM.

• Groups managed directly in STACKIT IAM can be managed through available STACKIT interfaces, such as the Portal or APIs. You can add or remove users, groups, and service accounts as members.
• SCIM-provisioned groups are synchronized from an external identity provider. They are read-only in the STACKIT Portal and must be managed in the external identity provider. For details, see SCIM endpoint STACKIT IdP.

Manage groups in the STACKIT Portal

Groups can contain users, other groups, and service accounts. To create a group or manage its members in the Portal, see Create and manage IAM groups.

Use groups in role bindings

A group can be selected as the subject of a Cloud Role binding. Assigning a role to a group grants the role’s permissions to the group’s members, including members of nested groups. To grant or change cloud-resource access, see Assign roles to a user or service account.