Introduction With the IBM Cloud® Identity and Access Management IAM Policy Management API, you can create, update, view, and delete IAM policies. An IAM policy enables a subject to access a resource. These policies are used in access decisions when you call APIs for IAM-enabled services. For more information about how access management works, see Managing access in IBM Cloudhttps://cloud.ibm.com/docs/account?topic=account-cloudaccess. There are three primary values in a policy: a subject, roles, and resources. The subject is who or what is being granted access. The subject can be an IAM ID or an access group ID. The IAM ID is the ID of the entity that you are giving access to. The value can be a user or a service ID. The access group ID is the ID of the access group. An access group contains a set of users or service IDs. Access groups are the preferred method of managing access control. For more information, see Setting up access groupshttps://cloud.ibm.com/docs/iam?topic=iam-groups. The following table shows the example formats for the supported subject types: Type | Attribute name | Attribute value | ------------ | ------------- | ------------- | User | iamid | IBMid-123456... | Service ID | iamid | iam-ServiceId-12345... | Access group | accessgroupid | AccessGroupId-12345... | The second value in a policy in the role. A role is a collection of actions that can be taken on a resource. There are platform, service, and custom roles. For more information, see IAM roleshttps://cloud.ibm.com/docs/account?topic=account-userrolesiamusermanrol. And, the final value of the policy is the targeted resources whether it's an entire service, resource group, or specific service instance. Two types of policies are supported: access policies and authorization policies. For more information, see Create a policyhttps://cloud.ibm.com/apidocs/iam-policy-managementcreate-a-policy. With policy templates and assignments you can centrally manage the policies for child accounts in your organization from the root enterprise account. For more information, see Working with template versionshttps://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-working-with-versions&interface=ui and Best practices for assigning access in an enterprisehttps://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-access-enterprises. SDKs for Java, Node, Python, and Go are available to make it easier to programmatically access the API from your code. The client libraries that are provided by the SDKs implement best practices for using the API and reduce the amount of code that you need to write. The tab for each language includes code examples that demonstrate how to use the client libraries. For more information about using the SDKs, see the IBM Cloud SDK Common projecthttps://github.com/IBM/ibm-cloud-sdk-common on GitHub. Installing the Go SDK Go modules recommended: Add the following import in your code, and then run go build or go mod tidy go import "github.com/IBM/platform-services-go-sdk/iampolicymanagementv1" Go get bash go get -u github.com/IBM/platform-services-go-sdk/iampolicymanagementv1 View on GitHub https://github.com/IBM/platform-services-go-sdkhttps://github.com/IBM/platform-services-go-sdk Installing the Java SDK Maven xml Method Path Summary GET /v1/policies Get policies by attributes POST /v1/policies Create a policy PUT /v1/policies/{policy_id} Update a policy GET /v1/policies/{policy_id} Retrieve a policy by ID DELETE /v1/policies/{policy_id} Delete a policy by ID PATCH /v1/policies/{policy_id} Restore a deleted policy by ID GET /v2/roles Get roles by filters POST /v2/roles Create a role PUT /v2/roles/{role_id} Update a role GET /v2/roles/{role_id} Retrieve a role by ID DELETE /v2/roles/{role_id} Delete a role by ID GET /v2/policies Get policies by attributes POST /v2/policies Create a policy PUT /v2/policies/{id} Update a policy GET /v2/policies/{id} Retrieve a policy by ID DELETE /v2/policies/{id} Delete a policy by ID GET /v1/policy_templates List policy templates by attributes POST /v1/policy_templates Create a policy template GET /v1/policy_templates/{policy_template_id} Retrieve latest version of a policy template DELETE /v1/policy_templates/{policy_template_id} Delete a policy template POST /v1/policy_templates/{policy_template_id}/versions Create a new policy template version GET /v1/policy_templates/{policy_template_id}/versions Retrieve policy template versions PUT /v1/policy_templates/{policy_template_id}/versions/{version} Update a policy template version DELETE /v1/policy_templates/{policy_template_id}/versions/{version} Delete a policy template version GET /v1/policy_templates/{policy_template_id}/versions/{version} Retrieve a policy template version POST /v1/policy_templates/{policy_template_id}/versions/{version}/commit Commit a policy template version GET /v1/policy_assignments Get policy template assignments POST /v1/policy_assignments Create a policy authorization template assignment GET /v1/policy_assignments/{assignment_id} Retrieve a policy assignment PATCH /v1/policy_assignments/{assignment_id} Update a policy authorization type assignment DELETE /v1/policy_assignments/{assignment_id} Remove a policy assignment GET /v1/accounts/{account_id}/settings/access_management Retrieve Access Management account settings by account ID PATCH /v1/accounts/{account_id}/settings/access_management Update Access Management account settings by account ID GET /v1/action_control_templates List action control templates by attributes POST /v1/action_control_templates Create an action control template GET /v1/action_control_templates/{action_control_template_id} Retrieve the latest version of an action control template DELETE /v1/action_control_templates/{action_control_template_id} Delete an action control template POST /v1/action_control_templates/{action_control_template_id}/versions Create a new action control template version GET /v1/action_control_templates/{action_control_template_id}/versions Retrieve action control template versions PUT /v1/action_control_templates/{action_control_template_id}/versions/{version} Update an action control template version DELETE /v1/action_control_templates/{action_control_template_id}/versions/{version} Delete an action control template version GET /v1/action_control_templates/{action_control_template_id}/versions/{version} Retrieve an action control template version POST /v1/action_control_templates/{action_control_template_id}/versions/{version}/commit Commit an action control template version GET /v1/action_control_assignments Get action control template assignments POST /v1/action_control_assignments Create an action control template assignment GET /v1/action_control_assignments/{assignment_id} Retrieve an action control assignment PATCH /v1/action_control_assignments/{assignment_id} Update an action control assignment DELETE /v1/action_control_assignments/{assignment_id} Remove an action control assignment GET /v1/role_templates List role templates by attributes POST /v1/role_templates Create role template GET /v1/role_templates/{role_template_id} Retrieve the latest version of a role template DELETE /v1/role_templates/{role_template_id} Delete a Role template POST /v1/role_templates/{role_template_id}/versions Create a new role template version GET /v1/role_templates/{role_template_id}/versions Retrieve role template versions PUT /v1/role_templates/{role_template_id}/versions/{version} Update a role template version DELETE /v1/role_templates/{role_template_id}/versions/{version} Delete a role template version GET /v1/role_templates/{role_template_id}/versions/{version} Retrieve a role template version POST /v1/role_templates/{role_template_id}/versions/{version}/commit Commit a role template version GET /v1/role_assignments Get role template assignments POST /v1/role_assignments Create a role template assignment GET /v1/role_assignments/{assignment_id} Retrieve a role assignment PATCH /v1/role_assignments/{assignment_id} Update a role assignment DELETE /v1/role_assignments/{assignment_id} Remove a role assignment