usage: tctl acl create [<flags>]

Create an access list.

Use --access-type if you want Teleport to create the supporting roles for you. It sets how members are granted access:

  standing       members get ongoing access to the resources set below.
  access-request members must request that access; owners approve.

These roles are built from the resource flags you set. Without --access-type, a plain access list is created with no roles, and you set its grants yourself.

Resource access (requires --access-type), grouped by target:

  SSH servers          --node-labels, --logins
  Databases            --db-labels, --db-users, --db-names
  Kubernetes           --kubernetes-labels, --kubernetes-users, --kubernetes-groups
  Windows desktops     --windows-labels, --windows-logins
  Git servers          --github-orgs
  AWS Identity Center  --aws-ic-assignments
  Web applications     --app-labels, --aws-role-arns, --azure-identities,
                       --gcp-service-accounts, --mcp-tools

Flags:
      --access-type=ACCESS-TYPE  How members are granted access: 'standing' (members get ongoing access to the resources described by the resource flags) or 'access-request' (members must request access;
                                 owners review). When omitted, a plain access list is created with no auto-generated roles. (one of: standing, access-request)
      --format=text              Output format. (one of: text, json)
      --title=TITLE              Display name for the access list.
      --audit-frequency=6        Audit recurrence in months (1, 3, 6, or 12).
      --audit-day=1              Day of month for audit (1, 15, or 31).
      --description=DESCRIPTION  Optional description.
      --owners=user1,user2,...   Usernames or emails who own this access list and review membership.
      --owner-access-lists=name1,name2,...
                                 Access list names to add as owners; their members inherit owner permissions on this access list (nested access lists).
      --members=user1,user2,...  Usernames or emails to add as members of the new access list. Members can also be added later with `tctl acl users add`.
      --member-access-lists=name1,name2,...
                                 Access list names to add as members; their members inherit this list's member grants (nested access lists).
      --owner-grant-roles=role1,role2,...
                                 Roles granted to owners of this access list.
      --owner-grant-traits=key=value,...
                                 Traits granted to owners of this access list.
      --owner-required-roles=role1,role2,...
                                 Roles a user must already have to be an owner of this access list.
      --owner-required-traits=key=value,...
                                 Traits a user must already have to be an owner of this access list.
      --member-grant-roles=role1,role2,...
                                 Roles granted to members of this access list.
      --member-grant-traits=key=value,...
                                 Traits granted to members of this access list.
      --member-required-roles=role1,role2,...
                                 Roles a user must already have to be a member of this access list.
      --member-required-traits=key=value,...
                                 Traits a user must already have to be a member of this access list.
      --node-labels=key=value,...
                                 Selects SSH servers members may access by label match.
      --logins=login1,login2,...
                                 OS logins members may use to connect to matched SSH servers.
      --db-labels=key=value,...  Selects databases members may access by label match.
      --db-users=user1,user2,...
                                 Database users members may connect as on matched databases.
      --db-names=name1,name2,...
                                 Database names members may connect to on matched databases.
      --kubernetes-labels=key=value,...
                                 Selects Kubernetes clusters members may access by label match.
      --kubernetes-users=user1,user2,...
                                 Kubernetes users members may impersonate on matched clusters.
      --kubernetes-groups=group1,group2,...
                                 Kubernetes groups members may impersonate on matched clusters.
      --app-labels=key=value,...
                                 Selects web apps members may access by label match. For AWS Identity Center apps, use --aws-ic-assignments instead.
      --aws-role-arns=arn1,arn2,...
                                 AWS role ARNs members may assume via matched apps.
      --azure-identities=id1,id2,...
                                 Azure managed identities members may assume via matched apps.
      --gcp-service-accounts=account1,account2,...
                                 GCP service accounts members may assume via matched apps.
      --mcp-tools=tool1,tool2,...
                                 MCP tools members may call on matched MCP apps.
      --windows-labels=key=value,...
                                 Selects Windows desktops members may access by label match.
      --windows-logins=login1,login2,...
                                 Logins members may use to connect to matched Windows desktops.
      --github-orgs=org1,org2,...
                                 Selects git servers members may access by GitHub organization name.
      --aws-ic-assignments=accountID^permSetARN,...
                                 Selects AWS Identity Center apps members may access by AWS account ID + permission set ARN ('accountID^permissionSetARN' pairs).
