Cloud IAM Create and Evolve a Custom Role

Cloud IAM Create and Evolve a Custom Role

Create a custom role, verify it, replace its actions, and list the account's custom roles.

1. Create the custom role with its initial action set, scoped to one service within the account. Custom roles extend the built-in platform and service roles rather than replacing them.
2. Read the role back to see the action set IBM actually persisted, which may differ from what was submitted if an action was rejected as invalid for the service.
3. Replace the role's definition with the revised action set. This is a full replace, not a merge — every action the role should retain must appear in the revised list or it is dropped, which is how a role gets narrowed toward least privilege.
4. List the account's roles for the service to confirm the revised role is visible to policy authors alongside the system and service roles they can choose from.

What you'll need to have ready

• accountId: The IBM Cloud account ID that owns the custom role.
• serviceName: The service the role applies to (e.g. "cloud-object-storage").
• roleName: The programmatic name identifier for the role (e.g. "ObjectReader").
• displayName: The human-readable display name shown to policy authors.
• actions: The initial set of actions the role grants.
• revisedActions: The complete revised action set. Replace semantics apply — this array becomes the role's entire action list, so any action omitted here is removed from the role
• ifMatch: The entity tag from a previous GET of this role, used for optimistic concurrency control on the replace. Note that this API description does not model an entity
• roleDescription: A description of what the custom role is for.

For your developer

Arazzo workflow ibm:custom-role-lifecycle, 4 operations: createRole → getRole → replaceRole → listRoles. Specs on APIs.io.