Cloud IAM Deprovision a Service ID
A 5-step recipe with IBM. We can help you get access.
Recipe · 5 steps
Cloud IAM Deprovision a Service ID
with IBM · Identity & Access Management
Find a service ID by name, confirm it is unused, then unlock and delete it.
- Resolve the service ID by name within the account. Matching on name rather than requiring the caller to supply an opaque id is what makes this runnable from a decommission ticket.
- List the service ID API keys in the account so the credentials that deletion will destroy are recorded first. This API description exposes no way to filter keys by a service ID's own identifier, so the inventory is scoped to all service ID
- Read the service ID with its activity and history to establish when it last authenticated. A recent last_authn means something still depends on this identity and the decommission should stop here.
- Unlock the service ID so it can be deleted. Identities provisioned for production are commonly locked at creation, and deletion is refused while the lock is in place.
- Delete the service ID and every API key associated with it. This cannot be undone, and any access policy written against the identity should be withdrawn separately or it is left dangling.
What you'll need to have ready
- accountId: The IBM Cloud account ID that owns the service ID.
- serviceIdName: The name of the service ID being retired.
For your developer
Arazzo workflow ibm:deprovision-service-id, 5 operations: listServiceIds → listApiKeys → getServiceId → unlockServiceId → deleteServiceId. Specs on APIs.io.