---
name: cloud-logs-iam-ingestion-trusted-profile
title: Generating a Trusted Profile for ingestion
description: You can use a Trusted Profile (TP) to send logs from a compute resource in IBM Cloud to an IBM Cloud Logs instance by using the Logging agent.
last-updated: 2025-09-25
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-logs?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Generating a Trusted Profile for ingestion
{: #iam-ingestion-trusted-profile}

You can use a Trusted Profile (TP) to send logs from a compute resource in IBM Cloud to an IBM Cloud Logs instance by using the Logging agent.
{: shortdesc}

An individual user ID API key should only be used for non-production environments. If the user creating the API key is no longer an authorized IBM Cloud user, individual user ID API keys associated with that user will no longer be authorized and ingestion will be stopped. Production environments should be configured using [Service ID API keys](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-iam-ingestion-serviceid-api-key&format=markdown) or [Trusted Profiles](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-iam-ingestion-trusted-profile&format=markdown).
{: important}


## Creating a Trusted Profile for ingestion
{: #iam-ingestion-trusted-profile-create}

Complete the following steps to create a Trusted Profile:

1. In the IBM Cloud console, click **Manage > Access (IAM) > Trusted profiles**. Then, click **Create profile**.

2. Describe your profile by providing a name and a description. Then, click **Continue**.

3. Establish trust. Select the trusted profile entity type **Compute resources**.

5. Create a trust relationship.

    Select a *Compute service type*.

    In the *Select compute resource* section, click **Specific resources> Add a resource**. Then, choose your resource.

    - For a **Kubernetes** compute service type, you must choose the Kubernetes cluster where you plan to deploy the agent; enter **ibm-observe** as the namespace; and enter **logs-agent** as the service account.

    - For a **Red Hat OpenShift on IBM Cloud** compute service type, you must choose the OpenShift cluster where you plan to deploy the agent; enter **ibm-observe** as the namespace; and enter **logs-agent** as the service account.

    - For a **Virtual Server for VPC** compute service type, you must choose an instance.

    Then, click **Continue**.

6. Assign access. Select **Access policy**.

    The role that is required for sending logs to IBM Cloud Logs is `Sender`. For more information, see [Setting up IAM permissions for ingestion](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-iam-ingestion-permissions&format=markdown).

    Make sure the user who grants the policy has the `Sender` role permissions.
    {: important}

    - Select the service **Cloud Logs**. Then, click **Next**.

    - In *Resources*, select **Specific resources**. Choose the IBM Cloud Logs instance where you plan to send the logs. Then, click **Next**.

    - In the **Roles and actions**, select the service access **Sender**. Then, click **Next**.

    - Click **Add > Create**.

For more information about the fields that are used to create conditions for trusted profiles, see IAM condition properties. {: tip}