Short answer: In Prefect Cloud (3.x), RBAC (service accounts, teams, roles, and object-level access) is administered in the UI. There is no officially supported way today to define or reconcile these as code via Python, Terraform, YAML, or the CLI. You can use service account API keys to automate orchestration tasks (deployments, schedules, runs), but the RBAC layer itself is not currently exposed as a supported API. What’s available today (Prefect 3.x): - Python SDK / PrefectClient: Full orchestration control (deployments, schedules, runs, blocks, work pools). Not RBAC. - Docs: API Client overview - CloudClient: Limited account/workspace utilities; no typed RBAC endpoints. It does expose a low-level

raw_request

if you want to call undocumented endpoints at your own risk. - Reference: CloudClient reference - CLI:

prefect cloud

covers login, selecting a workspace, opening the UI, IP allowlists, and webhooks. It does not manage service accounts, roles, teams, or ACLs. - Verified commands:

prefect cloud login|logout|open|workspace|ip-allowlist|webhook

- YAML: Used for deployments (

prefect deploy

), not for RBAC. - Terraform: No official Terraform provider for Prefect Cloud RBAC. Enterprise features: - Teams and object-level ACLs (deployments/blocks/work pools) are Enterprise features and are UI-driven today. - Docs: - Service accounts: Service accounts - Roles & permissions: Roles and permissions - Teams: Teams - Object ACLs: Object-level ACLs What you can do programmatically (supported) - Create/manage deployments and schedules using a service account API key (created in the UI). - Example: authenticate with a service account and list deployments

import os
from prefect import get_client

os.environ["PREFECT_API_KEY"] = "pnu_xxx"      # from a service account created in the UI
os.environ["PREFECT_API_URL"] = "<https://api.prefect.cloud/api/accounts/<acct_id>/workspaces/<ws_id>>"

async def main():
    async with get_client() as client:
        deployments = await client.read_deployments()
        print(f"{len(deployments)} deployments visible to this service account")

# run with: python -m asyncio <this_file>.py

Undocumented workaround (not recommended / may change without notice) - There are underlying REST endpoints used by the UI for RBAC, but they are not documented or supported for public automation. If you still want to experiment, you can make raw requests via

CloudClient.raw_request

. - Strong caveat: contracts can change without notice; no compatibility guarantees or support.

import asyncio
from prefect.client.cloud import get_cloud_client

async def list_service_accounts():
    async with get_cloud_client(api_key="pnu_xxx") as client:
        # Example path inferred from the UI; not officially supported
        resp = await client.raw_request(
            "GET",
            "accounts/{account_id}/service_accounts",
            path_params={"account_id": client.account_id},
        )
        print(resp.json())

asyncio.run(list_service_accounts())

Notes on “deployments, schedules, etc.” - Schedules are attached to deployments in Prefect 3.x. Programmatic creation/update of deployments and their schedules is fully supported (via Python/CLI), but who can do that is controlled by your workspace roles and (Enterprise) object ACLs set in the UI. If you can share which specific RBAC resources and relationships you want to manage as code (e.g., “create a service account, assign it to workspace X with role Y, grant read on deployment Z”), I can:

- Propose the best supported workflow today (using the UI for RBAC + automation for orchestration) - Or outline the exact sequence of raw API calls if you’re comfortable with undocumented endpoints and their risks.

You’re right — my earlier answer was out of date. Yes, you can use the Prefect Terraform provider to manage RBAC in Prefect Cloud. What you can manage with Terraform (Prefect Cloud, 3.x): - Service accounts: prefect_service_account - Workspace access (assign workspace roles to users/SAs/teams): prefect_workspace_access - Object-level ACLs: - Deployments: prefect_deployment_access - Blocks: prefect_block_access - Work pools: prefect_work_pool_access - Teams (Enterprise): prefect_team and team membership prefect_team_access - Custom workspace roles: prefect_workspace_role - Account member role management (import-only): prefect_account_member Terraform getting started guide (RBAC & permissions): Guide Key caveats and notes: - Cloud-only: These resources target Prefect Cloud (not OSS). - Plan requirements: Teams and some ACL features require Enterprise; most object-level ACL resources require Pro+. Check your plan. - Provider auth: Run Terraform with a user/SA API key that has the necessary account/workspace permissions; many org-wide ops require an Account Admin. - Object ACLs override workspace role access for that object. Once you set a deployment/block/work pool ACL, you must explicitly list who can view/run/manage it. - Account members: You can’t invite users via Terraform. Use the UI to invite; then you can import and manage their account role with

prefect_account_member

. Minimal example (service account + workspace access + deployment ACL) ``` terraform { required_providers { prefect = { source = "PrefectHQ/prefect" version = "~> 2.92.0" } } } provider "prefect" { account_id = var.account_id api_key = var.admin_api_key # user or SA with sufficient privileges } variable "account_id" {} variable "admin_api_key" { sensitive = true } # Your target workspace and role IDs (from UI or data sources) variable "workspace_id" {} variable "developer_workspace_role_id" {} variable "deployment_id" {} # 1) Create a service account for automation resource "prefect_service_account" "bot" { name = "terraform-bot" account_role_name = "Member" # or "Admin" if you need account-wide changes api_key_expiration = "2026-12-31T235959Z" } # 2) Grant the SA a workspace role (e.g., Developer) resource "prefect_workspace_access" "bot_access" { accessor_type = "SERVICE_ACCOUNT" accessor_id = prefect_service_account.bot.id workspace_id = var.workspace_id workspace_role_id = var.developer_workspace_role_id } # 3) Optional: lock down a deployment with an explicit ACL and grant the SA access resource "prefect_deployment_access" "bot_deployment_acl" { workspace_id = var.workspace_id deployment_id = var.deployment_id # Grant bot the ability to run/manage this deployment run_actor_ids = [prefect_service_account.bot.actor_id] manage_actor_ids = [prefect_service_account.bot.actor_id] } output "bot_api_key" { value = prefect_service_account.bot.api_key sensitive = true }

output "bot_actor_id" { value = prefect_service_account.bot.actor_id } ``` Other useful resources: - Teams and membership (Enterprise): prefect_team, prefect_team_access - Custom roles: prefect_workspace_role - Block ACLs: prefect_block_access - Work pool ACLs: prefect_work_pool_access To your original question about other “as code” modalities: - Python/CLI/YAML: still not for RBAC in 3.x. Use Terraform for RBAC-as-code. - REST API: the Terraform provider is the supported way to automate RBAC; direct RBAC endpoints are not publicly documented for DIY scripting. If you share your exact RBAC topology (e.g., “SAs A/B with Developer in WS X; team T with Viewer in WS Y; ACLs on deployments D1/D2”), I can draft a Terraform module or snippet that mirrors it.