capabilities.work

Cloud IAM Decommission a Trusted Profile

A 4-step recipe with IBM. We can help you get access.

Recipe · 4 steps

Cloud IAM Decommission a Trusted Profile

with IBM · Identity & Access Management

Resolve a trusted profile by name, revoke its claim rule, and delete the profile.

  1. Resolve the profile by name within the account, including its history so the reviewer can see who created the trust and when before it is torn down.
  2. List the claim rules attached to the profile. Each rule is a live path by which an external identity can assume this profile, so this is the inventory of what is about to be revoked.
  3. Delete the claim rule to sever the trust immediately. Profile deletion would remove this rule anyway, but revoking first means access stops the moment the decision is taken rather than at the end of the change window.
  4. Delete the trusted profile along with any remaining claim rules and links. This cannot be undone, and any access policy written against the profile's IAM ID is left dangling and should be cleaned up separately.
What you'll need to have ready
  • accountId: The IBM Cloud account ID the trusted profile belongs to.
  • profileName: The name of the trusted profile being retired.
For your developer

Arazzo workflow ibm:decommission-trusted-profile, 4 operations: listProfiles → listClaimRules → deleteClaimRule → deleteProfile. Specs on APIs.io.

More recipes with IBM

Cloud IAM Audit API Key Activity and HistoryCloud IAM Re-enable and Re-scope a Disabled API KeyCloud IAM Rotate an API KeyCloud IAM Authenticate and Inspect the Calling API KeyCloud IAM Update a Trusted Profile Claim RuleCloud IAM Create and Evolve a Custom RoleCloud IAM Grant an Identity Access with a PolicyCloud IAM Review and Deactivate an Access PolicyCloud IAM Change the Roles on an Existing PolicyCloud IAM Deprovision a Service ID