Manage Team Members

Manage tenant membership declaratively. Each member is a kupe_tenant_member resource — adding or removing one from your configuration adds or removes them from the tenant on the next apply.

# Full access for the lead developer
resource "kupe_tenant_member" "lead" {
  email = "lead@example.com"
  role  = "admin"
}

# Read-only for the rest of the team
resource "kupe_tenant_member" "dev1" {
  email = "dev1@example.com"
  role  = "readonly"
}

resource "kupe_tenant_member" "dev2" {
  email = "dev2@example.com"
  role  = "readonly"
}

email is immutable — changing it forces replacement (which removes the old member and adds a new one). role can be updated in place.

For the role definitions and permissions, see Manage Members via the API.