Creating and managing groups

Outcome

By the end of this lesson, you will be able to create, edit, and delete resource groups using the group management surface, knowing that a delete cannot be undone.

1. Concept

There are three things you do to a group: make it, change it, and delete it.

Each is one screen, and each has a small number of fields that matter.

Create

RESOURCE GROUPS → New Group
─────────────────────────────────────────────────────────
Name:           [descriptive name]           e.g., "dev-platform-aws"
Description:    [one-line purpose]           e.g., "Dev platform team's
                                                      EC2 + RDS + EKS in AWS"

[Cancel]                                                       [Create]

Two fields, and only the name is required. The group starts empty; members come next. A group has no budget or tag fields of its own: a budget is a separate object you create on the Budgets page and point at the group.

Edit

RESOURCE GROUP: dev-platform-aws
─────────────────────────────────────────────────────────
  [Settings ▾] [Members 34] [Attached 1 schedule, 1 budget]

NAME:           dev-platform-aws                     [Edit]
DESCRIPTION:    Dev platform team's AWS EC2+RDS+EKS  [Edit]

CREATED:        2026-02-12 by jane@zopcloud.com
UPDATED:        2026-05-19 by jane@zopcloud.com
─────────────────────────────────────────────────────────

Each field edits in place.

Renaming is worth one note. Anything already written down, an audit log entry or an old notification, keeps the name the group had at the time. Only new events use the new name. That is deliberate: a record of what happened should not change because somebody renamed something afterwards.

Delete

Deleting a group is final:

DELETE GROUP "dev-platform-aws"?
─────────────────────────────────────────────────────────
This group has:
  - 34 members
  - 1 attached schedule (dev-business-hours)
  - 1 attached budget ($4,000/month)

Deleting will:
  - Remove the group from the active list
  - Detach the schedule from this group (members lose that
    schedule; a group member never holds a direct attachment)
  - Remove the budget tracking for this group
  - Remove all memberships (members become ungrouped resources)

Type "dev-platform-aws" to confirm:
[                                                    ]

[Cancel]                                              [Delete group]

Name-confirmation pattern (same as schedule delete in M1.3). Prevents accidental deletion, and it is your only safety net.

Behind the scenes, ZopNight marks the group as deleted and, in the same step, removes its memberships and its schedule links. There is no restore: no Deleted Groups section, no recovery window. To undo a mistaken delete, create the group again, add the members back and reattach the schedule.

The resources themselves are not touched. They stay in ZopNight as ungrouped resources, free to join another group.

What a group does NOT carry

Three things are explicitly NOT properties of a group:

1. Resource membership. Members are stored in a separate table. The group has a reference; the membership table is the source of truth for “which resources are in this group.”
2. Attachment state. Schedule and budget attachments are managed separately. A group can exist with no attachments (useful for organizational grouping without operations).
3. Cloud-side mirrors. A ZopNight group is not the same as an AWS Resource Group or Azure Management Group. ZopNight’s groups are organizational only; they do not modify cloud-side metadata.

Permissions

Group management permissions sit under the RBAC entity resource-group (covered fully in the Architect track’s RBAC module):

ACTION                  DEFAULT ROLES (Viewer / Editor / Admin)
─────────────────────────────────────────────────────────
List groups             V, E, A   (everyone can see groups)
Create group             E, A
Edit group metadata     E, A
Add / remove members    E, A
Delete group             E, A

Viewers can see groups but not modify them. Editors handle day-to-day group management, including deleting a group.

2. Demo

A team setting up groups for the first time:

T+0       Team has 187 non-prod resources, no groups yet
T+5 sec   Open Resource Groups page → see empty list

T+15 sec  Click "New Group"
T+45 sec  Fill in:
            Name: dev-platform-eu
            Description: EU dev team's primary environment
T+50 sec  Save (group created empty)

T+1 min   Repeat for "staging-services-eu" with a description

T+1.5 min Open "dev-platform-eu" → click "Add Resource"
T+1.7 min In the Add Resources drawer: Search: dev (matches name,
          UID or tag values), All Cloud Accounts: eu-aws-account
          Result: 12 resources
T+2.2 min Tick each of the 12, click "Add 12 Resources"
T+2.3 min 12 resources are now members

T+2.5 min Open the schedule "business-hours-eu"
T+2.7 min Click "Attach Group" → pick "dev-platform-eu"
T+2.8 min Schedule now applies to all 12 group members

REPEAT for staging-services-eu. Total time: ~5 minutes for two groups.

Five minutes to set up the organizational scaffolding. New resources added to either group going forward inherit all attachments automatically.

3. Hands-on (6 min)

Create your first group:

1. Open Resource Groups → New Group.
2. Fill in a descriptive name (env + team + cloud).
3. Add a one-sentence description.
4. Save.
5. The group is created empty.
6. (Continuing in L3) Add members.

If you have permission to delete (Editor or Admin role): create a
throwaway test group with no members and delete it. Note the
name-confirmation step. Confirm the group is gone from the list and
that there is no way to bring it back.

Do it through MCP. The same task you just did in the console, asked in one sentence.

BEFORE  A ZopNight account with one cloud connected. Three or more discovered resources, ideally an app tier and its database: EC2 plus RDS, Compute Engine plus Cloud SQL, or Azure VMs plus SQL Database.
ASK     "Put these resources in a group called sandbox-nightly and attach the group to the nightly schedule."
CHECK   the group membership. Exclusive membership still applies: a resource that is already in another group is rejected, so remove it from that group first.

Tools behind it: create_resource_group (write, tier 2, reversible), add_resource_to_group (write, tier 2, reversible), attach_group_to_schedule (write, tier 2, reversible). Connection details are in the MCP integration docs.

4. Knowledge check

Q1

A team deletes a group by mistake an hour ago. What can they do?

A. Recreate it, then re-add the members and reattach its schedule
B. Restore it from the Deleted Groups section within 30 days
C. Ask an Admin to roll the delete back from the Audit Log
D. Wait, since deleted groups return after the nightly sync

Q2

A team renames a group from “dev-cluster” to “dev-platform-eu.” Past audit logs:

A. Are deleted
B. Preserve the original name for that point in time
C. Are all renamed retroactively across the board
D. Become unsearchable

Q3

A group has 34 members, 1 attached schedule, 1 attached budget. Deleting the group has what immediate effect on members?

A. The members are deleted from ZopNight entirely as well
B. Members are stopped
C. Members are duplicated
D. Members continue to exist as resources in the resource table

5. Apply

Group lifecycle operations:

• Resource Groups page: list, create, search
• Per-group page: settings, members, attachments
• Delete Group (on the group page): name-confirmed and final

For the bulk member management mechanics, continue to L3.

Related lessons

• L3: Bulk add and remove with search (next)
• L4: Sequenced execution
• T4.M4.1: RBAC