Cloud IAM Grant an Identity Access with a Policy
A 3-step recipe with IBM. We can help you get access.
Recipe · 3 steps
Cloud IAM Grant an Identity Access with a Policy
with IBM · Identity & Access Management
List a service's roles, create an access policy for an identity, and verify it.
- List the system, service, and custom roles the target service exposes in this account. This confirms the service is real and surfaces the role CRNs that are legal to grant before any policy is written.
- Grant the subject the chosen role on the target service within the account. The subject is identified by its IAM ID and the resource is narrowed by account and service name.
- Read the policy back to confirm the roles and resources that were actually persisted and that the policy is active rather than pending.
What you'll need to have ready
- accountId: The IBM Cloud account ID the policy is scoped to.
- iamId: The IAM ID of the subject being granted access — a user, a service ID, or a trusted profile.
- serviceName: The service the policy grants access to (e.g. "cloud-object-storage").
- roleCrn: The CRN of the role to grant (e.g. "crn:v1:bluemix:public:iam::::role:Viewer"). Run this workflow once and read the discoverRoles outputs to find the grantable
- policyDescription: A human-readable description recording why the access was granted.
For your developer
Arazzo workflow ibm:grant-identity-access, 3 operations: listRoles → createPolicy → getPolicy. Specs on APIs.io.