Access Control Model

Fivetran access control for Terraform is built around four entities:

• Users - Individual Fivetran account holders. Users have a role that determines their global permissions.
• Teams - A named collection of users. Teams can be granted access to groups and connections, making it easier to manage access at scale without individual grants.
• Groups - A workspace that contains a destination and its connections. Access to a group implies access to all connections in that group unless connection-level overrides are set.
• Connections - An individual data pipeline (represented by the fivetran_connection_v2 resource). Connections can have its own access grants independent of the parent group.

The Terraform provider exposes these as separate membership resources — one per relationship type. Learn how the entities relate, which resource to use for each access pattern, and the recommended approach for enterprise setups.

Membership resources

The provider exposes the following resources for managing access:

Individual grants vs. team-based grants

Individual grants

Use fivetran_group_users or fivetran_user_group_membership when access is personal and not shared with others:

resource "fivetran_group_users" "analyst_access" {
  group_id = fivetran_group.main.id
  user {
    user_id = "analyst_user_id"
    role    = "Destination Analyst"
  }
}

• When to use: Small teams, personal access grants, users who need temporary or one-off permissions.
• When to avoid: Using individual grants at scale. As your team grows, managing access person-by-person produces fragile Terraform configurations that are hard to audit.

Team-based grants (recommended for enterprise use cases)

Create a team, add users to it, then grant the team access to groups or connections:

resource "fivetran_team" "data_engineers" {
  name        = "Data Engineers"
  description = "Team responsible for pipeline infrastructure"
  role        = "Account Reviewer"
}

resource "fivetran_team_user_membership" "data_engineers_members" {
  team_id = fivetran_team.data_engineers.id
  user {
    user_id = "user_id_1"
    role    = "Team Member"
  }
  user {
    user_id = "user_id_2"
    role    = "Team Member"
  }
}

resource "fivetran_team_group_membership" "data_engineers_group" {
  team_id  = fivetran_team.data_engineers.id
  group_id = fivetran_group.main.id
  role     = "Destination Administrator"
}

• When to use: Any setup with more than a few people, or where team membership already maps to an organizational structure (squad, domain, business unit).
• Advantages: Adding a new member to the team automatically inherits all group and connection grants. Removing a member revokes all grants at once.

Connection-level access

Team and user grants at the group level apply to all connections in that group. For cases where a team or user needs access to a specific connection but not the whole group, use fivetran_team_connector_membership or fivetran_user_connector_membership:

resource "fivetran_team_connector_membership" "analytics_team_connector" {
  team_id      = fivetran_team.analytics.id
  connector_id = fivetran_connector.salesforce.id
  role         = "Connector Administrator"
}

Recommended enterprise pattern

For most enterprise setups, we recommend the following structure to keep access manageable and auditable:

• One team per domain or squad to mirror your organizational structure
• Use team-to-group grants so each team owns the groups relevant to its domain
• Use individual grants only for exceptions, such as temporary access scenarios, on-call engineers, and cross-team collaboration

# Teams
resource "fivetran_team" "platform" {
  name = "Platform"
  role = "Account Administrator"
}

resource "fivetran_team" "marketing_analytics" {
  name = "Marketing Analytics"
  role = "Account Reviewer"
}

# Group access
resource "fivetran_team_group_membership" "platform_owns_all" {
  team_id  = fivetran_team.platform.id
  group_id = fivetran_group.main.id
  role     = "Destination Administrator"
}

resource "fivetran_team_group_membership" "marketing_reads" {
  team_id  = fivetran_team.marketing_analytics.id
  group_id = fivetran_group.marketing.id
  role     = "Destination Analyst"
}

Roles reference

For the full list of available roles and their permissions, use the fivetran_roles data source:

data "fivetran_roles" "all" {}

output "available_roles" {
  value = data.fivetran_roles.all.roles[*].name
}