Getting Started with IAM

Identity and Access Management roles

Every user that accesses the IBM Cloud® Object Storage service in your account must be assigned an access policy with an IAM user role defined. That policy determines what actions the user can perform within the context of the service or instance you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.

Policies enable access to be granted at different levels. Some of the options include the following:

• Access across all instances of the service in your account
• Access to an individual service instance in your account
• Access to a specific bucket within an instance (see Bucket permissions)
• Access to all IAM-enabled services in your account
• Access to a specific object or group of objects within a bucket

After you define the scope of the access policy, you assign a role. Review the following tables which outline what actions each role allows within the Object Storage service.

The following table details actions that are mapped to platform management roles. Platform management roles enable users to perform tasks on service resources at the platform level, for example assign user access for the service, create or delete service IDs, create instances, and bind instances to applications.

The following table details actions that are mapped to service access roles. Service access roles enable users access to Object Storage as well as the ability to call the Object Storage API.

For information about assigning user roles in the UI, see Managing IAM access.

Identity and Access Management actions