Managing service access

App Configuration uses IBM Cloud® Identity and Access Management (IAM) to perform authorization and authentication.

Access to App Configuration service instances for users in your account is controlled by IBM Cloud® Identity and Access Management (IAM). Every user in your account who needs access to App Configuration, must be assigned with an IAM role with specific access policy. The access policy determines what actions that a user can perform within the context of the service or instance that you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.

Policies help you to grant access at different levels. Some of the options are:

Access across all instances of the service in your account.
Access to an individual service instance in your account.
Access to specific Feature flags & Properties only within a Collection. See tutorial.
Access to all Feature flags & Properties within a specific Environment. See tutorial.

Roles and permissions

With IBM Cloud IAM, you can manage and define access for users and resources in your account. App Configuration service aligns with IBM Cloud IAM roles so that each user has a different view of the service, according to the role assigned.

Roles define the actions that a user or service ID can run. The following types of roles are in IBM Cloud:

Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, create or delete service IDs, create instances, assign policies for your service to other users, or bind instances to applications.
Service access roles enable users to be assigned varying levels of permission for calling the service's API.

App Configuration uses both the Platform and Service management roles. You can set policies about who can create an instance at the platform level, and then use the service roles to manage interaction with the instance itself. As the creator of an instance, you do not need to set any IAM policies to view or work with your App Configuration entities.

For complete IAM documentation, see Managing access in IBM Cloud.

Review the platform and service roles available and the actions that are mapped to each to help you assign access. If you're using the API to assign access, use apprapp for the service name.

IAM user roles
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the platform role name and the column headers identify the specific information available about each role.
Role	Description
Viewer	As a viewer, you can view service instances, but you can't modify them.
Administrator	As an administrator, you can perform all platform actions based on the resource this role is being assigned, including assigning access policies to other users.
Operator	As an operator, you can perform platform actions that are required to configure and operate service instances, such as viewing a service's dashboard.
Editor	As an editor, you can perform all platform actions except for managing the account and assigning access policies.

IAM service access roles
Use the tab buttons to change the context of the table. This table has row and column headers. The row headers provide the service role name and the column headers identify the specific information available about each role.
Role	Description
Manager	As a manager, you have permissions beyond the writer role to complete privileged actions as defined by the service. In addition, you can create and edit service-specific resources.
Reader	As a reader, you can perform read-only actions within a service such as viewing service-specific resources.
Writer	As a writer, you have permissions beyond the reader role, including creating and editing service-specific resources.
Config Operator	As a Config Operator, you can toggle the feature state.
Client SDK	As a Client SDK role, you have permissions to perform evaluation of feature flags and properties in your application integrated with client SDK.
Workflow operator	As a workflow operator, you have permissions beyond the reader role, allowing you to create workflows that initiate an approval process using ServiceNow.
Configuration Aggregator Reader	As a Configuration Aggregator Reader, you have permission to query for the configuration metadata of resources.
Configuration Update Reporter	As a Configuration Update Reporter, you have permissions to report the change in Cloud resource configuration to Configuration aggregator.

Actions

The following table details actions that are mapped to service access roles. Service access roles enable users access to App Configuration as well as the ability to call the App Configuration API.

Granular IAM action descriptions.
Action ID	Roles	Description
`apprapp.dashboard.view`	Manager, Writer, Config Operator, Reader	View App Configuration dashboard
`apprapp.collections.list`	Manager, Writer, Config Operator, Reader, ClientSDK	The ability to view collections.
`apprapp.collections.create`	Manager	The ability to create collections.
`apprapp.collections.update`	Manager	The ability to edit or update existing collections.
`apprapp.collections.delete`	Manager	The ability to delete existing collections.
`apprapp.environments.list`	Manager, Writer, Config Operator, Reader	The ability to view environments.
`apprapp.environments.create`	Manager	The ability to create environments.
`apprapp.environments.update`	Manager	The ability to update or edit existing environments.
`apprapp.environments.delete`	Manager	The ability to delete existing environments.
`apprapp.features.list`	Manager, Writer, Config Operator, Reader	The ability to view feature flags.
`apprapp.features.create`	Manager	The ability to create feature flags.
`apprapp.features.update`	Manager	The ability to update or edit existing feature flags.
`apprapp.features.delete`	Manager	The ability to delete existing feature flags.
`apprapp.features.patch`	Writer	The ability to partially update or edit existing feature flags.
`apprapp.features.toggle`	Manager, Writer, Config Operator	The ability to enable or disable existing feature flags.
`apprapp.features-rules.list`	Manager, Reader, Writer, Configoperator	The ability to list targeting rules of a feature flag.
`apprapp.features-rules.create`	Manager, Writer	The ability to create a new rule in feature flag's targeting.
`apprapp.features-rules.patch`	Manager, Writer	The ability to update an existing rule in feature flag's targeting.
`apprapp.features-rules.delete`	Manager	The ability to delete an existing rule from feature flag's targeting.
`apprapp.features-rules-order.patch`	Manager, Writer	The ability to re-order the rules of feature flag's targeting.
`apprapp.features-rollout-action.patch`	Manager	The ability to update or edit rollout configuration for existing feature flags.
`apprapp.features-rules-rollout-action.patch`	Manager, Writer	The ability to update or edit rollout configuration of any existing feature flag rule.
`apprapp.properties.list`	Manager, Writer, Config Operator, Reader	The ability to view properties.
`apprapp.properties.create`	Manager	The ability to create properties.
`apprapp.properties.update`	Manager	The ability to update or edit existing properties.
`apprapp.properties.delete`	Manager	The ability to delete existing properties.
`apprapp.properties.patch`	Writer	The ability to partially update or edit existing properties.
`apprapp.segments.list`	Manager, Writer, Config Operator, Reader	The ability to view segments.
`apprapp.segments.create`	Manager, Writer	The ability to create segments.
`apprapp.segments.update`	Manager, Writer	The ability to update or edit existing segments.
`apprapp.segments.delete`	Manager, Writer	The ability to delete existing segments.
`apprapp.gitconfigs.view`	Manager, Writer, Config Operator, Reader	The ability to view Git configurations.
`apprapp.gitconfigs.create`	Manager	The ability to create Git configurations.
`apprapp.gitconfigs.update`	Manager	The ability to update or edit existing Git configurations.
`apprapp.gitconfigs.delete`	Manager	The ability to delete existing Git configurations.
`apprapp.integrations.list`	Manager, Writer, Config Operator, Reader	The ability to view integrations existing between App Configuration service and external services such as Key Protect & Event Notifications.
`apprapp.integrations.create`	Manager	The ability to create integrations between App Configuration service and external services such as Key Protect and Event Notifications.
`apprapp.integrations.delete`	Manager	The ability to delete the existing integrations between App Configuration service and an external services such as Key Protect & Event Notifications.
`apprapp.originconfigs.list`	Manager, Writer, Config Operator, Reader	The ability to view allowlisted origin URLs.
`apprapp.originconfigs.update`	Manager	The ability to add or update origin URLs to the allowlist.
`apprapp.workflow-configs.list`	Workflowoperator, Manager, Reader	List workflow configurations.
`apprapp.workflow-configs.create`	Workflowoperator, Manager	Create workflow configurations.
`apprapp.workflow-configs.update`	Workflowoperator, Manager	Update workflow configurations.
`apprapp.workflow-configs.delete`	Workflowoperator, Manager	Delete workflow configurations.
`apprapp.workflow-configs.toggle`	Workflowoperator, Manager	Enable/Disable workflow configurations.
`apprapp.changerequest.create`	Manager	The ability to send ServiceNow change request events to App Configuration instance.
`apprapp.config.export`	Manager, Writer, Config Operator, Reader, ClientSDK	The ability to get the JSON export of entire App Configuration instance resources such as collections, environments, feature flags, properties & segments.
`apprapp.config.import`	Manager	The ability to import resources such as collections, environments, feature flags, properties & segments into App Configuration instance.
`apprapp.config.action`	Manager	The ability to promote or restore the existing Git configurations.
`apprapp.config.status`	Configoperator, Manager, Reader, Writer	The ability to view the status of import or export operation.
`apprapp.sse.view`	Manager, Writer, Config Operator, Reader, ClientSDK	The ability for a EventSource to subscribe to server-sent events. This action is used by App Configuration Client SDKs only.
`apprapp.usage.create`	Manager, Writer, Config Operator, Reader, ClientSDK	The ability to submit feature flags & properties evaluation metrics back to App Configuration.
`apprapp.clientsdk-apikey.encrypt`	Manager	The ability to obtain the encrypted ClientSDK apikey for a given plain ClientSDK apikey.
`apprapp.config-aggregator.query`	ConfigurationAggregatorReader, Manager	The ability to list the IBM cloud resources with their configurations.
`apprapp.config-aggregator-atevents.ingest`	Manager, ConfigurationUpdateReporter	The ability to ingest events from Activity tracker to Configuration Aggregator.
`apprapp.config-aggregator.filter`	ConfigurationAggregatorReader, Manager	Batch query API to retrieve resource metadata of specified resources from Config Aggregator.
`apprapp.config-aggregator-settings.update`	Manager	Update the settings for the Configuration aggregator.
`apprapp.config-aggregator-settings.list`	Manager, Reader, Writer, Configoperator	Retrieve the settings for the Configuration aggregator.
`apprapp.config-aggregator-status.read`	Manager, Reader, Writer, Configoperator	Retrieve the status of resource collection for the Configuration aggregator.
`apprapp.config-aggregator-scope.read`	Manager, Reader, Writer, Configoperator	Retrieve the account scope of resource collection for the Configuration aggregator.
`apprapp.config-aggregator.reconcile`	Manager	The ability to perform the reconciliation of the resources metadata.
`apprapp.config-aggregator-nlp.query`	ConfigurationAggregatorReader, Manager	The ability to interact with all the NLP APIs of configuration aggregator.
`apprapp.config-aggregator-nlp-history.create`	ConfigurationAggregatorReader, Manager	The ability to store the conversation of NLP query API.
`apprapp.config-aggregator-nlp-history.update`	ConfigurationAggregatorReader, Manager	The ability to edit the conversation of resource config NLP API.
`apprapp.config-aggregator-nlp-history.query`	ConfigurationAggregatorReader, Manager	The ability to list or view older conversations of resource config query API.
`apprapp.config-aggregator-nlp-job-result.query`	ConfigurationAggregatorReader, Manager	The ability to view the result of a job triggered from resource config query.
`apprapp.config-aggregator-nlp-job.query`	ConfigurationAggregatorReader, Manager	The ability to view the details of a job triggered by resource config query.
`apprapp.config-aggregator-nlp-jobs.query`	ConfigurationAggregatorReader, Manager	The ability to list or view all the job triggered from resource config query.
`apprapp.config-aggregator-nlp-jobs.create`	ConfigurationAggregatorReader, Manager	The ability to save or create a job triggered from resource config query.