Outcome
By the end of this lesson, you will be able to create, edit, and soft-delete resource groups using the group management surface.
| Tier | Operator |
| JTBD | ”Set up a group with the right metadata so future engineers don’t ask me what it is.” |
| Personas | Platform Engineer · FinOps Analyst |
| Prerequisites | L1 |
| Time | 10 minutes |
| Bloom verb | Create, Edit, Soft-delete (Apply) |
1. Concept
There are four things you do to a group: make it, change it, delete it, and bring it back.
Each is one screen, and each has a small number of fields that matter.
Create
RESOURCE GROUPS → New Group─────────────────────────────────────────────────────────Name: [descriptive name] e.g., "dev-platform-aws"Description: [one-line purpose] e.g., "Dev platform team's EC2 + RDS + EKS in AWS"Budget: [optional $ amount] e.g., $4,000/monthTags: [optional key-value pairs] e.g., owner=platform-team, environment=dev
[Cancel] [Create]Four fields, two of them required. The group starts empty; members come next.
Edit
RESOURCE GROUP: dev-platform-aws───────────────────────────────────────────────────────── [Settings ▾] [Members 34] [Attached 1 schedule, 1 budget]
NAME: dev-platform-aws [Edit]DESCRIPTION: Dev platform team's AWS EC2+RDS+EKS [Edit]BUDGET: $4,000/month [Edit]TAGS: owner=platform-team, env=dev [Edit]
CREATED: 2026-02-12 by jane@zopcloud.comUPDATED: 2026-05-19 by jane@zopcloud.com─────────────────────────────────────────────────────────Each field edits in place.
Renaming is worth one note. Anything already written down, an audit log entry or an old notification, keeps the name the group had at the time. Only new events use the new name. That is deliberate: a record of what happened should not change because somebody renamed something afterwards.
Soft delete
Groups can be deleted, but the deletion is soft by default:
DELETE GROUP "dev-platform-aws"?─────────────────────────────────────────────────────────This group has: - 34 members - 1 attached schedule (dev-business-hours) - 1 attached budget ($4,000/month)
Deleting will: - Remove the group from the active list - Detach the schedule from this group (resources stay scheduled only if they had a per-resource attachment too) - Remove the budget tracking for this group - Mark group as soft-deleted (recoverable for 30 days)
Type "dev-platform-aws" to confirm:[ ]
[Cancel] [Delete group]Name-confirmation pattern (same as schedule delete in M1.3). Prevents accidental deletion. The group is recoverable for 30 days from a Deleted Groups section on the Resource Groups page.
After 30 days, the group is permanently purged. Members are not affected by the purge: they exist independently of the group.
Restore
For a soft-deleted group within the 30-day window:
DELETED GROUPS─────────────────────────────────────────────────────────NAME DELETED RESTORE BYdev-platform-aws 2 days ago 28 days remaining [Restore]old-staging-group 14 days ago 16 days remaining [Restore]─────────────────────────────────────────────────────────Restore brings the group back with its members and attachments intact. Useful for “we deleted this last week and now we realize we shouldn’t have.”
What a group does NOT carry
Three things are explicitly NOT properties of a group:
- Resource membership. Members are stored in a separate table. The group has a reference; the membership table is the source of truth for “which resources are in this group.”
- Attachment state. Schedule and budget attachments are managed separately. A group can exist with no attachments (useful for organizational grouping without operations).
- Cloud-side mirrors. A ZopNight group is not the same as an AWS Resource Group or Azure Management Group. ZopNight’s groups are organizational only; they do not modify cloud-side metadata.
Permissions
Group management permissions sit under the RBAC entity resource-group (covered fully in 1):
ACTION DEFAULT ROLES (Viewer / Editor / Admin)─────────────────────────────────────────────────────────List groups V, E, A (everyone can see groups)Create group E, AEdit group metadata E, AAdd / remove members E, ASoft-delete group ARestore group APermanent purge A (or automatic after 30 days)Viewers can see groups but not modify them. Editors handle most day-to-day group management. Admins handle deletion and restore.
2. Demo
A team setting up groups for the first time:
T+0 Team has 187 non-prod resources, no groups yetT+5 sec Open Resource Groups page → see empty list
T+15 sec Click "New Group"T+45 sec Fill in: Name: dev-platform-eu Description: EU dev team's primary environment Budget: $2,500/month Tags: owner=platform-eu, environment=devT+50 sec Save (group created empty)
T+1 min Repeat for "staging-services-eu" with description, budget, tags
T+1.5 min Open "dev-platform-eu" → click "Add members"T+1.7 min Filter resources: environment=dev, account=eu-aws-account Result: 67 resourcesT+1.8 min Select all 67, click "Add to group"T+1.9 min 67 resources are now members
T+2 min Open the schedule "business-hours-eu"T+2.2 min Click "Attach Group" → pick "dev-platform-eu"T+2.3 min Schedule now applies to all 67 group members
REPEAT for staging-services-eu. Total time: ~5 minutes for two groups.Five minutes to set up the organizational scaffolding. New resources added to either group going forward inherit all attachments automatically.
3. Hands-on (6 min)
Create your first group:
1. Open Resource Groups → New Group.2. Fill in a descriptive name (env + team + cloud).3. Add a one-sentence description.4. Set a budget if you have a target (optional).5. Add 1-2 tags (owner, environment).6. Save.7. The group is created empty.8. (Continuing in L3) Add members.
If you have permission to delete (Admin role): try soft-deleting atest group. Confirm the name-confirmation pattern. Note the 30-dayrestore window. Restore the group to practice that flow.Do it through MCP. The same task you just did in the console, asked in one sentence.
BEFORE A ZopNight account with one cloud connected. Three or more discovered resources, ideally an app tier and its database: EC2 plus RDS, Compute Engine plus Cloud SQL, or Azure VMs plus SQL Database.ASK "Put these resources in a group called sandbox-nightly and attach the group to the nightly schedule."CHECK the group membership. Exclusive membership still applies: a resource added here leaves whatever group it was in.Tools behind it: create_resource_group (write, tier 2, reversible), add_resource_to_group (write, tier 2, reversible), attach_group_to_schedule (write, tier 2, reversible). The full catalogue is at zop.dev/learn/mcp-tools.
4. Knowledge check
Q1
A team deletes a group. The 30-day window allows:
A. The group to be restored as if no deletion happened, including members and attachments
B. The group carries on operating quietly away in the background exactly as before
C. AWS notifications to fire
D. Budget tracking to continue
Show answer
Correct: A. After 30 days, the group is purged permanently and cannot be restored. Soft-delete is recoverable. The 30-day window is a safety net for accidental deletes. After that, the group is permanently gone (members and attachments are not).
Q2
A team renames a group from “dev-cluster” to “dev-platform-eu.” Past audit logs:
A. Are deleted
B. Preserve the original name for that point in time
C. Are all renamed retroactively across the board
D. Become unsearchable
Show answer
Correct: B. New events use the new name. The rename is not retroactive in the audit history. Audit history is immutable. The old name persists in historical records; the new name applies to future events. This is the standard pattern for renames in audit-friendly systems.
Q3
A group has 34 members, 1 attached schedule, 1 attached budget. Soft-deleting the group has what immediate effect on members?
A. The members are deleted from ZopNight entirely as well
B. Members are stopped
C. Members are duplicated
D. Members continue to exist as resources in the resource table
Show answer
Correct: D. They are removed from the group, so the schedule no longer applies via the group. The budget for the group is removed. If the schedule had per-resource attachments too, those persist independently. Members are independent of the group. Soft-deleting the group is metadata-only: it does not modify resources. The attachment relationship is what changes.
5. Apply
Group lifecycle operations:
- Resource Groups page: list, create, search
- Per-group page: settings, members, attachments
- Deleted Groups section: restore within 30 days
For the bulk member management mechanics, continue to L3.
Related lessons
Glossary terms touched
Soft delete · Restore window · Name-confirmation · Group metadata