User accounts

gitlab_settings_users is a list of user account entries keyed by username. Each entry converges one account: creation with a derived or declared credential policy, attribute convergence, the block/unblock lifecycle, and deletion. Managing users requires an administrator credential.

Users plan before groups and projects

In a gitlab_settings_resource: all apply, user operations plan and apply ahead of groups and projects, so a membership can reference a username created in the same run. state: absent deletes the account — GitLab performs the deletion asynchronously, so an immediately repeated check may briefly still observe the account.

Example

gitlab_settings_users:
  - username: alice
    user:
      name: Alice Example
      email: alice@example.com
      force_random_password: true
      can_create_group: false
  - username: bob
    custom_attributes:
      team: platform
    user:
      state: blocked        # offboarding: block an existing account
  - username: mallory
    state: absent           # delete the account

User Entry Spec

username string Required The account's natural identity; GitLab's numeric id is resolved through the API.	Example: gitlab_settings_users: - username: alice ...
state string  User-entry lifecycle. absent deletes the account. Can be one of: present, absent Default: present	Example: gitlab_settings_users: - username: mallory state: absent ...
force_secret_update boolean  Rewrite the declared password on an existing account. Passwords are never compared or implicitly rewritten. Default: false	Example: gitlab_settings_users: - username: alice force_secret_update: true user: password: "{{ vault_new_password }}" ...
custom_attributes object  Arbitrary key/value metadata, reconciled per key like group and project custom attributes ([Custom attributes API](https://docs.gitlab.com/api/custom_attributes/)). The user's numeric id is resolved before any request. Properties of custom_attributes  <attribute name> string The map key is the custom-attribute identity; the value must be bounded text.	Example: gitlab_settings_users: - username: bob custom_attributes: team: platform ...
user object  Account attributes and account-state controls. Unsupported fields are rejected with the field name in the error. Properties of user  name stringRequired on create  email stringRequired on create  admin boolean Compares against GitLab's is_admin response field.  auditor boolean  external boolean  can_create_group boolean  note string  bio string  location string  state string Can be one of: active, blocked. Uses GitLab's dedicated block/unblock verbs. A state cannot be declared while creating an account; create it first, then converge its state.  password stringRequired on create unless generated Required on create unless force_random_password or reset_password is true. This write-only credential is not logged. On an existing account it is rewritten only when entry-level force_secret_update is true.  force_random_password boolean Creation-time control; never compared afterward.  reset_password boolean Creation-time control; never compared afterward.  skip_confirmation boolean Creation-time control; never compared afterward. A pure account-state transition performs only the dedicated verb; attribute and state drift in one entry perform both. Deactivated accounts are not managed yet.	Example: gitlab_settings_users: - username: alice user: name: Alice Example email: alice@example.com force_random_password: true ...