Skip to main content

vRA Projects

Audience: Cloud Operations and Platform Engineering teams.

Purpose: Manage projects that control access to cloud templates and deployment destinations.

Overview​

Projects in vRealize Automation (vRA) control:

  • Who has access to cloud templates
  • Where cloud templates can be deployed

Projects are typically organized by:

  • Organizational structure (cost center)
  • Business group or purpose
  • Billing code and data classification
End-User Documentation

Public documentation is available at support.cloud.tamu.edu

Project Types​

TypeManagementCreation Method
LegacyManual changesMigrated from AggieCloud 1.0
NewTerraform/IaCServiceNow + GitHub pipeline
Best Practice

All new projects should be created using the automated pipeline. Legacy projects should be migrated when possible.

Creating a New Project​

Process Steps​

  1. User submits request via ServiceNow Form
  2. Request processed by team (usually Joseph Rafferty)
  3. ServiceNow initiates PR against aip-ac-foundation
  4. GitHub Action runs terraform plan
  5. Codeowner approves if plan looks good
  6. Terraform applies to create the project

Project Tags​

All new projects have three mandatory tags applied to deployments:

TagPurposeExample
onboardingProject identifierproject-name
BillingCodeCost allocation02-123456
DataClassificationSecurity levelpublic, confidential
warning

Only new deployments are automatically tagged. Onboarded (migrated) deployments are not automatically tagged.

User Management​

All vRA access is controlled using AUTH Active Directory groups.

Group OU Path:

OU=vCenter Groups,OU=Role Groups,OU=Groups,OU=Infrastructure Services,DC=auth,DC=tamu,DC=edu

Management Locations​

LocationPurposeAccess
vIDMAuthentication & syncvidm.it.tamu.edu
IAM in vRALogin permissionsIdentity & Access Management
ProjectsDeployment accessProjects

Group Naming Conventions​

TypeFormat
LegacyvRA-<legacy-project-name>@auth.tamu.edu
NewRSG-<new-project-name>-vraaccess@auth.tamu.edu

vIDM Sync​

VMware Identity Manager (vIDM) syncs users and groups from AUTH Active Directory nightly.

Manual Sync Procedure​

How to Manually Sync
  1. Login to vIDM
  2. Select dropdown next to your name → Administration Console
  3. Select Identity & Access Management tab
  4. Find the AUTH directory → click Sync Now
  5. Review changes in the popup → click Sync Directory

View Synced Users/Groups​

  1. Login to vIDM
  2. Navigate to Users & Groups tab
  3. Select Users or Groups sub-tab

Adding Users to Legacy Projects​

Legacy User Management Steps
  1. User submits ServiceNow ticket
  2. Validate approval with supervisor or project contact
  3. Connect to a VM with ADUC access (e.g., techbox, net-advisor, bt-test1)
  4. Open Active Directory Users and Computers
  5. Navigate to the vCenter Groups OU
  6. Find the group: vRA-<project-name>
  7. Add the user to the group
  8. Sync vIDM (or wait for nightly sync)

Adding Users to New Projects​

New Project User Management Steps
  1. User submits ServiceNow ticket
  2. Validate approval with supervisor or project contact
  3. Clone the aip-ac-foundation repository
  4. Create branch: add-user/INC<snow-number>
  5. Edit the project's definition.json:
"owners": [
    "netID1@tamu.edu",
    "netID2@tamu.edu",
    "netID3@tamu.edu"
],
  1. Open a pull request
  2. GitHub Action runs terraform plan
  3. Codeowner approves
  4. Terraform applies to add user to AD
vIDM Sync

If the user is new to vRA (not in any other project), a manual vIDM sync may be required.

Identity & Access Management in vRA​

Controls which areas of vRA users can access.

  • Default access: Service Broker only (catalog and deployments)
  • Permissions: Typically granted to AD groups, not individuals

Access IAM​

  1. Login to AggieCloud
  2. From Cloud Services Console → Identity and Access Management
  3. Select Active Users or Enterprise Groups