Cloud IAM Change the Roles on an Existing Policy

Cloud IAM Change the Roles on an Existing Policy

Replace an existing policy's roles while preserving its subjects and resources.

1. Read the policy as it stands. The subjects and resources captured here are carried through the replace unchanged — this step is what prevents the replace from silently rebinding or orphaning the grant.
2. List the roles the service exposes so the incoming role CRN can be checked against what is actually grantable, rather than discovering it is invalid when the replace rejects the whole policy.
3. Replace the policy with the new role, reusing the type, subjects, and resources read from the live policy. Everything not restated in this body is lost, which is why nothing here is reconstructed from assumptions.

What you'll need to have ready

• accountId: The IBM Cloud account ID the policy is scoped to.
• policyId: The unique identifier of the policy whose roles are changing.
• serviceName: The service the policy grants access to, used to resolve grantable roles.
• newRoleCrn: The CRN of the role that should replace the policy's current roles (e.g. "crn:v1:bluemix:public:iam::::role:Editor").
• ifMatch: The entity tag from a previous GET of this policy, used for optimistic concurrency control. Note that this API description does not model an entity tag on the P
• changeDescription: A description recording why the role changed and who approved it.

For your developer

Arazzo workflow ibm:change-policy-roles, 3 operations: getPolicy → listRoles → replacePolicy. Specs on APIs.io.