---
title: "Admin-level grants in Terraform | Metacenta"
description: "Which Terraform grants we treat as admin-level, such as roles/owner and ACCOUNTADMIN, why they matter for a data platform, and when an admin grant is right."
url: "https://metacenta.com/rules/tf-broad-grant"
updated: "2026-10-14"
tokens: 584
---

Repository hygiene · rule tf-broad-grant

# Admin-level grants in Terraform

A Metacenta review checks this under the rule **Grants are narrower than admin**. Everything below applies whether or not you ever commission one.

## What this rule checks

This rule flags IAM, grant, role and policy resources that grant an admin-level role as a literal value. Those are `roles/owner`, `roles/editor`, `ACCOUNTADMIN`, `SECURITYADMIN`, `SYSADMIN`, `ALL PRIVILEGES`, `*` and the AWS `AdministratorAccess` policy. A role set from a variable reads as unknown and is not flagged.

## Why it matters

Whoever holds the grant can read, change or delete any data in scope. They can also grant the same access to others.

## How to fix it

**Narrow the admin-level grants in Terraform.** Grant the narrowest role the job needs, such as a dataset-level reader. Keep admin roles for break-glass accounts.

Before:

```hcl
resource "google_project_iam_member" "analysts" {
  project = var.project_id
  role    = "roles/editor"
  member  = var.analyst_group
}
```

After:

```hcl
resource "google_bigquery_dataset_iam_member" "analysts" {
  dataset_id = var.marts_dataset
  role       = "roles/bigquery.dataViewer"
  member     = var.analyst_group
}
```

## When it is fine to leave

A break-glass account needs admin rights. So can the identity Terraform itself runs as in a bootstrap stack. Keep those few grants together, with a comment saying why. Tell us, and the finding comes out of your report.

## What we need to check it

The `.tf` files you supply. We refuse `.tfvars` and state files by name, and read only literal values from each resource. With no grant resource declared, the rule does not apply.

[Ask about a review](https://metacenta.com/enquire?src=rule-tf-broad-grant&via=md)

## Related pages

- [Credential files committed to a data repository](https://metacenta.com/rules/repo-committed-credential-file)
- [Data repository with no CI pipeline](https://metacenta.com/rules/repo-no-ci)
- [Archived repositories under review](https://metacenta.com/rules/repo-archived)
- [Data repository with no tests](https://metacenta.com/rules/repo-no-tests)
- [A sample review, as a client reads it](https://metacenta.com/sample)
- [All published rules](https://metacenta.com/rules)
- [How a review is assessed](https://metacenta.com/standard)