Cloud IAM Review and Deactivate an Access Policy

Cloud IAM Review and Deactivate an Access Policy

Enumerate a subject's active access policies, inspect one, and transition it to deleted state.

1. List every active policy granting this subject access in the account. This is the complete standing-access picture for the identity, and the reason offboarding cannot stop at deleting the identity itself.
2. Read the target policy before changing it so the roles and resources being withdrawn are captured for the audit record. Once the state transition lands, this is the only evidence of what the identity previously held.
3. Transition the policy to the deleted state, withdrawing the grant. This is a state change rather than a hard delete, so the policy remains queryable with state=deleted for later audit.

What you'll need to have ready

• accountId: The IBM Cloud account ID whose policies are under review.
• iamId: The IAM ID of the subject whose standing access is being reviewed.
• policyId: The unique identifier of the policy to deactivate.
• ifMatch: The entity tag from a previous GET of this policy, used for optimistic concurrency control. Note that this API description does not model an entity tag on the P
• policyType: Restrict the review to access or authorization policies.

For your developer

Arazzo workflow ibm:review-and-deactivate-policy, 3 operations: listPolicies → getPolicy → updatePolicyState. Specs on APIs.io.