---
name: codeengine-trusted-profiles
title: Working with trusted profiles in Code Engine to access IBM Cloud services
description: You can configure your Code Engine components (applications, jobs, or functions) to use IAM trusted profiles to authorize Code Engine components and access IBM Cloud® services without managing separate credentials. Trusted profiles do not require storing and managing secret credentials. No maintenance or credential rotation are needed.
last-updated: 2026-07-08
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/codeengine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Working with trusted profiles in Code Engine to access IBM Cloud services
{: #trusted-profiles}

You can configure your Code Engine components (applications, jobs, or functions) to use IAM trusted profiles to authorize Code Engine components and access IBM Cloud® services without managing separate credentials. Trusted profiles do not require storing and managing secret credentials. No maintenance or credential rotation are needed.
{: shortdesc}

Before you enable an application, job, or function to access IBM Cloud services to use a trusted profile, you require an IBM Cloud® Identity and Access Management (IAM) trusted profile. Create a trusted profile in IAM that trusts your Code Engine component as a compute resource and grant access to the target service. See [Trusted profiles for federated users and workloads](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&interface=ui&format=markdown) to create your trusted profile.

The Code Engine application, job, or function then needs access to a compute resource token so that it can identify itself and authenticate as an Code Engine component for IAM. This token authenticates the services to which the Code Engine component is allowed to communicate. Trusted profiles control the specific services with which the Code Engine component can communicate.

You can enable Code Engine to provide this token to the application, job, or function, to provide full trusted profile support in Code Engine, by using the Code Engine console or the CLI.

## Configuring Code Engine to support trusted profiles by using the console
{: #configuring-trusted-profiles-ui}
{: ui}

The following steps describe locating an existing Code Engine application, job, or function and then enabling trusted profiles support. When you create a new application, job, or function, you can enable trusted profiles during the creation, by using the **Optional settings** > **Service access** section.
{: tip}

### Configuring a Code Engine application to use trusted profiles
{: #configuring-trusted-profiles-app-ui}
{: ui}

1. Select your project from the [Projects page in the Code Engine console](https://cloud.ibm.com/codeengine/projects){: external}.
2. Click the name of your project to open the Overview page.
3. Click **Applications** to open a list of your applications. Click the name of your application to open its application page.
4. Click **Service access** > **Trusted profiles**.
5. Set the **Enable trusted profiles** option to **Enabled**. When you enable this application for trusted profiles, Code Engine provides a token that the application's code can use to match trusted profiles by project or by application name.
6. [Enable your application code to authenticate trusted profiles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file&format=markdown).

### Configuring a Code Engine job to use trusted profiles
{: #configuring-trusted-profiles-job-ui}
{: ui}

1. Select your project from the [Projects page in the Code Engine console](https://cloud.ibm.com/codeengine/projects){: external}.
2. Click the name of your project to open the Overview page.
3. Click **Jobs** to open a list of your jobs. Click the name of your job to open its job page.
4. Click **Service access** > **Trusted profiles**.
5. Set the **Enable trusted profiles** option to **Enabled**. When you enable this job for trusted profiles, Code Engine provides a token that the job's code can use to match trusted profiles by project or by job name.
6. [Enable your job code to authenticate trusted profiles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file&format=markdown).

### Configuring a Code Engine function to use trusted profiles
{: #configuring-trusted-profiles-function-ui}
{: ui}

1. Select your project from the [Projects page in the Code Engine console](https://cloud.ibm.com/codeengine/projects){: external}.
2. Click the name of your project to open the Overview page.
3. Click **Functions** to open a list of your functions. Click the name of your function to open its function page.
4. Click **Service access** > **Trusted profiles**.
5. Set the **Enable trusted profiles** option to **Enabled**. When you enable this function for trusted profiles, Code Engine provides a token that the function's code can use to match trusted profiles by project or by function name.
6. [Enable your function code to authenticate trusted profiles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file&format=markdown).

## Configuring Code Engine to support trusted profiles by using the CLI
{: #configuring-trusted-profiles-cli}
{: cli}

### Configuring a Code Engine application to use trusted profiles
{: #configuring-trusted-profiles-app-cli}
{: cli}

1. Select your Code Engine project. For example:

    ```txt
    ibmcloud ce project select --name myproject
    ```
    {: pre}

2. Enable trusted profile support:
    * By default, when you create a new Code Engine application, trusted profile support is not enabled. To enable trusted profiles support when you create a new application, use the `trusted-profiles-enabled=true` setting. For example:

        ```txt
        ibmcloud ce app create --name myapp --image icr.io/codeengine/hello --trusted-profiles-enabled=true
        ```
        {: pre}

    * If you have an existing application and want to enable trusted profile support for it, update it with the `trusted-profiles-enabled=true` setting. For example:

        ```txt
        ibmcloud ce app update --name myapp --trusted-profiles-enabled=true
        ```
        {: pre}

        If required, you can later disable trusted profiles support by updating the application with the `trusted-profiles-enabled=false` setting.
        {: tip}

3. [Enable your application code to authenticate trusted profiles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file&format=markdown).

### Configuring a Code Engine job to use trusted profiles
{: #configuring-trusted-profiles-job-cli}
{: cli}

1. Select your Code Engine project. For example:

    ```txt
    ibmcloud ce project select --name myproject
    ```
    {: pre}

2. Enable trusted profile support:
    * By default, when you create a new Code Engine job, trusted profile support is not enabled. To enable trusted profiles support when you create a new job, use the `trusted-profiles-enabled=true` setting. For example:

        ```txt
        ibmcloud ce job create --name myjob --image icr.io/codeengine/helloworld --trusted-profiles-enabled=true
        ```
        {: pre}

    * If you have an existing job and want to enable trusted profile support for it, update it with the `trusted-profiles-enabled=true` setting. For example:

        ```txt
        ibmcloud ce job update --name myjob --trusted-profiles-enabled=true
        ```
        {: pre}

        If required, you can later disable trusted profiles support by updating the job with the `trusted-profiles-enabled=false` setting.
        {: tip}

3. [Enable your job code to authenticate trusted profiles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file&format=markdown).

### Configuring a Code Engine function to use trusted profiles
{: #configuring-trusted-profiles-function-cli}
{: cli}

1. Select your Code Engine project. For example:

    ```txt
    ibmcloud ce project select --name myproject
    ```
    {: pre}

2. Enable trusted profile support:
    * By default, when you create a new Code Engine function, trusted profile support is not enabled. To enable trusted profiles support when you create a new function, use the `trusted-profiles-enabled=true` setting. For example:

        ```txt
        ibmcloud ce fn create --name myhellofun --inline-code main.js --runtime nodejs --trusted-profiles-enabled=true
        ```
        {: pre}

    * If you have an existing function and want to enable trusted profile support for it, update it with the `trusted-profiles-enabled=true` setting. For example:

        ```txt
        ibmcloud ce fn update --name myhellofun --trusted-profiles-enabled=true
        ```
        {: pre}

        If required, you can later disable trusted profiles support by updating the function with the `trusted-profiles-enabled=false` setting.
        {: tip}

3. [Enable your function code to authenticate trusted profiles](https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file&format=markdown).