--- name: atracker-iam title: Managing access with IAM description: IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud. Access to IBM Cloud Activity Tracker Event Routing service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). last-updated: 2025-01-09 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/atracker?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Managing access with IAM {: #iam} IBM Cloud® Identity and Access Management (IAM) enables you to securely authenticate users and control access to all cloud resources consistently in the IBM Cloud. Access to IBM Cloud Activity Tracker Event Routing service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). {: shortdesc} The access policy that you assign users in your account determines what actions a user can perform within the context of the service or specific instance that you select. The allowable actions are customized and defined by Activity Tracker Event Routing as operations that are allowed to be performed on the service. An action is mapped to an IAM platform or service role that you can assign to a user. If you have the IAM permission to create policies and authorizations, you can grant only the level of access that you have as a user of the target service. For example, if you have viewer access for the target service, you can assign only the viewer role for the authorization. If you attempt to assign a higher permission such as administrator, it might appear that permission is granted, however, only the highest level permission you have for the target service, that is viewer, will be assigned. {: important} ## IBM Cloud platform roles {: #platform} The following tables detail actions that are mapped to platform roles. Platform roles enable users to perform tasks on service resources at the platform level, for example, assign user access for the service, create or delete instances, and bind instances to applications. Review the following tables that outline what types of tasks each role allows for when you're configuring Activity Tracker Event Routing in your account. Use the following table to identify the **Account management** **Activity Tracker Event Routing** platform role that you can grant a user in the IBM Cloud to run any of the following platform actions: | Platform role | Description of actions | |--------------------------|------------------------| | Viewer | As a viewer, you can view Activity Tracker Event Routing configuration resources such as routes and targets. | | Operator | As an operator, you can view Activity Tracker Event Routing configuration resources such as routes and targets. | | Editor | As an editor, you can view, create, update, and delete Activity Tracker Event Routing resources such as routes and targets. | | Administrator | As an administrator, you can view, create, update, and delete Activity Tracker Event Routing resources. You can also assign access policies to manage Activity Tracker Event Routing resources to other users in the account. | {: caption="IAM platform roles for Activity Tracker Event Routing" caption-side="top"} {: summary="Descriptions of the actions in the service that are permitted for the listed platform management role."} ## IAM actions by task {: #iam_ater_bytask} Review the available platform roles that are available, and the actions that are mapped to each to help you assign access. For Activity Tracker Event Routing, the IAM actions and Activity Tracker actions are the same. {: note} | Action | IAM and Activity Tracker action | Administrator | Editor | Operator | Viewer | |--------|------------|---------------|--------|-----------|--------| | Grant other account members access to configure Activity Tracker Event Routing | `iam-am.policy.create` |![Checkmark icon](../../icons/checkmark-icon.svg) | | | | | Revoke member access to configure Activity Tracker Event Routing | `iam-am.policy.delete` | ![Checkmark icon](../../icons/checkmark-icon.svg) | | | | | Modify member access to configure Activity Tracker Event Routing | `iam-am.policy.update` | ![Checkmark icon](../../icons/checkmark-icon.svg) | | | | {: caption="IAM platform roles for Activity Tracker Event Routing access actions" caption-side="top"} | Action | IAM and Activity Tracker action | Administrator | Editor | Operator | Viewer | |--------|------------|---------------|--------|-----------|--------| | View a target | `atracker.target.read` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | List all targets | `atracker.target.list` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | Create a target | `atracker.target.create` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | | | Update a target | `atracker.target.update` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | | | Delete a target | `atracker.target.delete` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | | {: caption="IAM platform roles for Activity Tracker Event Routing target actions" caption-side="top"} | Action | IAM and Activity Tracker | Administrator | Editor | Operator | Viewer | |--------|------------|---------------|--------|-----------|--------| | View a route | `atracker.route.read` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | List all routes | `atracker.route.list` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | Create a route | `atracker.route.create` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | | | Update a route | `atracker.route.update` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | | | Delete a route | `atracker.route.delete` |![Checkmark icon](../../icons/checkmark-icon.svg) |![Checkmark icon](../../icons/checkmark-icon.svg) | | | {: caption="IAM platform roles for Activity Tracker Event Routing route actions" caption-side="top"} | Action | IAM and Activity Tracker action | Administrator | Editor | Operator | Viewer | |--------|------------|---------------|--------|-----------|--------| | View configuration settings | `atracker.setting.get` | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | ![Checkmark icon](../../icons/checkmark-icon.svg) | | Update configuration settings | `atracker.setting.update` | ![Checkmark icon](../../icons/checkmark-icon.svg) | | | | {: caption="IAM platform roles for Activity Tracker Event Routing configuration actions" caption-side="top"} ## Assigning access to IBM Cloud Activity Tracker Event Routing {: #iam-assign-access-how} For details on assigning access, see [Assigning access to IBM Cloud Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-iam&format=markdown). ## How do I know which access policies are set for me? {: #iam_accesspolicy} You can see which access policies are set for you in the [IBM Cloud UI](https://cloud.ibm.com/){: external} console. 1. Go to [Access IAM users](https://cloud.ibm.com/iam/users){: external}. 2. Click your name in the user table. 3. Click the **Access policies** tab to see your access policies. 4. Click the **Access groups** tab to see the access groups where you are a member. Check the policies for each group.