IAM condition properties

Example

The following table includes values for each of the fields for a dynamic rule or a trusted profile condition. In this example, users who are identified as managers within the federated IdP are mapped to an IBM Cloud access group or trusted profile that has specific access set for only managers.

Kubernetes and Red Hat OpenShift attribute names

Virtual server for VPC attribute names

Linking a trusted profile to Kubernetes a cluster

To link the trusted profile Test to the Kubernetes cluster c0pigdctkkc07fs7pm06 in the account 444aebb0657c7f0f3aae8e7bdc78709a and service account my-service-account in the namespace my-namespace, specify the following command:

ibmcloud iam trusted-profile-link-create Test --name NewLink4IKS --cr-type IKS_SA \
               --link-crn 
crn:v1:bluemix:public:containers-kubernetes:us-east:a/444aebb0657c7f0f3aae8e7bdc78709a:c0pigdctkkc07fs7pm06:: \
              --link-namespace "my-namespace" \
              --link-name "my-service-account"

Creating trusted profile conditions for Kubernetes

To connect the trusted profile with the ID Profile-b2f13064-2b8c-4e4b-9181-c1973a408e3c to all service accounts in the Kubernetes cluster c0pigdctkkc07fs7pm06 in the account 444aebb0657c7f0f3aae8e7bdc78709a and the service account namespace my-namespace, specify the following command:

ibmcloud iam trusted-profile-rule-create Profile-b2f13064-2b8c-4e4b-9181-c1973a408e3c \
              --name NewRule4IKS --type Profile-CR --cr-type IKS_SA \
               --conditions "claim:service_instance,operator:EQUALS,vlaue:c0pigdctkkc07fs7pm06" \
               --conditions "claim:namespace,operator:EQUALS,value:my-namespace"

Creating trusted profile conditions for VPC

To connect the trusted profile with the ID Profile-b2f13064-2b8c-4e4b-9181-c1973a408e3c to all virtual servers in one VPC r206-1db73eed-b0fb-b04f-bb57-4d3a3c2dff9d in the account 444aebb0657c7f0f3aae8e7bdc78709a, specify the following command:

ibmcloud iam trusted-profile-rule-create Profile-b2f13064-2b8c-4e4b-9181-c1973a408e3c \
              --name NewRule4VSI --type Profile-CR --cr-type VSI \
               --conditions "claim:vpc_id,operator:EQUALS,value:r206-1db73eed-b0fb-b04f-bb57-4d3a3c2dff9d"

Example: dayOfWeekAnyOf, timeGreaterThanOrEquals, and timeLessThanOrEquals

The days of the week that are specified in this example map to Monday, Tuesday, Wednesday, and Thursday. The timeGreaterThanOrEquals value indicates that the condition begins granting access at 9 AM in the time zone UTC-5. The timeLessThanOrEquals value indicates that the condition terminates access at 5 PM in the time zone UTC-5.environment.attributes.current_time and environment.attributes.day_of_week indicate that it is a recurring time-based condition. Always include time conditions with a dayOfWeek condition.

"conditions": [
			{
				"key": "{{environment.attributes.day_of_week}}",
				"operator": "dayOfWeekAnyOf",
				"value": [
					1,
					2,
					3,
					4
				]
			},
			{
				"key": "{{environment.attributes.current_time}}",
				"operator": "timeGreaterThanOrEquals",
				"value": "09:00:00-05:00"
			},
			{
				"key": "{{environment.attributes.current_time}}",
				"operator": "timeLessThanOrEquals",
				"value": "17:00:00-05:00"
			}
		]

Example: dayOfWeekEquals

The day of the week in this example is represented by 3 in the value string, which maps to Wednesday. In that same string, +6:00 represents the time zone UTC+6:00. There's only one condition, so it's nested under "rule".

"rule": {
		"key": "{{environment.attributes.day_of_week}}",
		"operator": "dayOfWeekEquals",
		"value": "3+06:00"
},

Example: dateTimeGreaterThanOrEquals and dateTimeLessThanOrEquals

In this example, the dateTimeGreaterThanOrEquals value indicates that the condition begins granting access on 26 December 2022 at 9 AM in the UTC-5 time zone. The dateTimeLessThanOrEquals value indicates that the condition terminates access on 27 December 2022 at 5 PM in the UTC-5 time zone. environment.attributes.current_date_time indicates that it is a temporary time-based condition.

"conditions": [
			{
				"key": "{{environment.attributes.current_date_time}}",
				"operator": "dateTimeGreaterThanOrEquals",
				"value": "2022-12-26T09:00:00-05:00"
			},
			{
				"key": "{{environment.attributes.current_date_time}}",
				"operator": "dateTimeLessThanOrEquals",
				"value": "2022-12-27T17:00:00-05:00"
			}
		]

Example: stringMatchAnyOf and stringEqualsAnyOf

In this example, the stringMatchAnyOf values for the resource.attributes.path variable indicates that access is granted when the object path matches and begins with either home/David/*, special/*, restricted/*, or temporary/test*spatial.?.log (e.g. temporary/test_spatial.1.log). The or value indicates that there is an alternative condition that can grant access.

The stringEqualsAnyOf value for the resource.attributes.delimiter variable indicates that access is granted when there is no boundary indicator or when / is present. Additionally, the stringEqualsAnyOffor the resource.attributes.prefix variable indicates that home/, or home/David/, or no prefix must also exist to grant access. The and value let's us know that both the resource.attributes.delimiter and resource.attributes.prefix must be met to grant access.

"pattern": "attribute-based-condition:resource:literal-and-wildcard",
"rule": {
    "operator": "or",
    "conditions": [
      {
        "key": "{{resource.attributes.path}}",
        "operator": "stringMatchAnyOf",
        "value": [
          "home/David/*",
          "special/*",
          "restricted/*",
          "temporary/test*spatial.?.log"
        ]
      },
      {
        "operator": "and",
        "conditions": [
          {
            "key": "{{resource.attributes.delimiter}}",
            "operator": "stringEqualsAnyOf",
            "value": [
              "",
              "/"
            ]
          },
          {
            "key": "{{resource.attributes.prefix}}",
            "operator": "stringEqualsAnyOf",
            "value": [
              "",
              "home/",
              "home/David/"
            ]
          }
        ]
      }
    ]
  }

Example: stringExists, stringEquals, stringMatch

In this example, stringEquals for iam_id, accountID, serviceName, and resourceType indicates that an exact string match is performed. The asterisk present in the stringMatch value for the resource variable indicates that access is granted to all resources that begin with dev-bucket-. The true stringExists value for the path variable and the false stringExists value for the prefix and delimiter variable indicates that only the path must exist to grant access.

{
    "type": "access",
    "subject": {
        "attributes": [
            {
                "key": "iam_id",
                "operator": "stringEquals",
                "value": "IBMid-1234"
            }
        ]
    },
    "control": {
        "grant": {
            "roles": [
                {
                    "role_id": "crn:v1:bluemix:public:cloud-object-storage::::role:ListFolderContent"
                },
                {
                    "role_id": "crn:v1:bluemix:public:cloud-object-storage::::role:ListFolder"
                },
                {
                    "role_id": "crn:v1:bluemix:public:cloud-object-storage::::role:AllFolderOperations"
                }
            ]
        }
    },
    "resource": {
        "attributes": [
            {
                "name": "accountId",
                "operator": "stringEquals",
                "value": "account-123"
            },
            {
                "key": "serviceName",
                "operator": "stringEquals",
                "value": "cloud-object-storage"
            },
            {
                "key": "serviceInstance",
                "operator": "stringEquals",
                "value": "cd329d97-c33d-4428-b39e-6170dc1c2a1e"
            },
            {
                "key": "resource",
                "operator": "stringMatch",
                "value": "dev-bucket-*"
            },
            {
                "key": "resourceType",
                "operator": "stringEquals",
                "value": "bucket"
            }
        ]
    },
    "rule": {
        "operator": "and",
        "conditions": [
            {
                "key": "{{resource.attributes.path}}",
                "operator": "stringExists",
                "value": true
            },
            {
                "key": "{{resource.attributes.prefix}}",
                "operator": "stringExists",
                "value": false
            },
            {
                "key": "{{resource.attributes.delimiter}}",
                "operator": "stringExists",
                "value": false
            }
        ]
    }
}