---
name: codeengine-iam
title: Managing user access
description: Access to IBM Cloud® Code Engine service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the Code Engine service in your account must be assigned an access policy with an IAM role defined. The policy determines what actions a user can perform within the context of the service or instance that you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles.
last-updated: 2026-07-08
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/codeengine?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Managing user access
{: #iam}

Access to IBM Cloud® Code Engine service instances for users in your account is controlled by IBM Cloud Identity and Access Management (IAM). Every user that accesses the Code Engine service in your account must be assigned an access policy with an IAM role defined. The policy determines what actions a user can perform within the context of the service or instance that you select. The allowable actions are customized and defined by the IBM Cloud service as operations that are allowed to be performed on the service. The actions are then mapped to IAM user roles. 
{: shortdesc}

*Policies* enable access to be granted at different levels.

*Roles* define the actions that a user or service ID can run. There are different types of roles in the IBM Cloud:

* *Platform management roles* enable users to perform tasks on Code Engine resources at the platform level, for example assign user access for Code Engine, create or delete service IDs, create projects, and assign policies for Code Engine to other users.
* *Service access roles* enable users to be assigned varying levels of permission for calling the Code Engine API.

Code Engine uses both the Platform and Service management roles. You can set policies about who can create a project at the platform level, and then use the service roles to manage interaction with the project itself. 

Want to learn more about IAM key concepts? Check out [Getting started with IBM Cloud IAM](https://cloud.ibm.com/docs/iam?topic=iam-iamoverview&format=markdown).
{: tip}

## How do I know which access policies are set for me?
{: #iam-accesspolicy}

You can see which access policies are set for you in the [IBM Cloud® Identity and Access Management (IAM)](https://cloud.ibm.com/iam/overview) console. Be sure to check [access policies](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&format=markdown) that apply to your user, and any access policies that are assigned to any [access groups](https://cloud.ibm.com/docs/iam?topic=iam-groups&format=markdown) that include your user.

To view IAM information about your user access,

1. Go to [Access IAM users](https://cloud.ibm.com/iam/users){: external}.
2. Click your name in the user table.
3. Click the **Access policies** tab to see your access policies.

To view IAM information about access groups for your user, 

1. Go to [Access IAM groups](https://cloud.ibm.com/iam/groups){: external}.
2. Click the name of an access group to view information about the group. 
3. Click the **Access** tab to see your access policies assigned to the group.


## Managing access by using access groups
{: #groups}

To manage access or assign new access for users by using access groups, you must be the account owner, administrator, or editor on all Identity and Access enabled services in the account, or the assigned **Administrator** or **Editor** for the IAM Access Groups Service. 

Choose any of the following actions to manage access groups in the IBM Cloud:

* [Creating an access group](https://cloud.ibm.com/docs/iam?topic=iam-groups&interface=ui&format=markdown#create_ag).
* [Assigning access to a group](https://cloud.ibm.com/docs/iam?topic=iam-groups&interface=ui&format=markdown#access_ag).

For more information about IAM commands, see the [IAM CLI reference docs](https://cloud.ibm.com/docs/iam?topic=iam-ibmcloud_commands_iam&format=markdown).

## Managing access by assigning policies directly to users
{: #users}

To manage access or assign new access for users by using IAM policies, you must be the account owner, administrator on all services in the account, or an administrator for the particular service or service instance. 

Choose any of the following actions to manage IAM policies in the IBM Cloud:

* To grant permissions to a user, see [Assigning access to resources](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&format=markdown#assign-new-access).
* To revoke permissions, see [Removing access](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&interface=ui&format=markdown#removing-access-console).
* To review a user's permissions, see [Reviewing assigned access](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&interface=ui&format=markdown#review-your-access-console).

For more information about IAM commands, see the [IAM CLI reference docs](https://cloud.ibm.com/docs/iam?topic=iam-ibmcloud_commands_iam&format=markdown).

## IBM Cloud platform roles
{: #platform}

Platform management roles enable users to perform tasks on service resources at the platform level, for example, assign user access for the service, create or delete instances, and bind instances to applications.

In Code Engine, [`projects`](https://cloud.ibm.com/docs/codeengine?topic=codeengine-manage-project&format=markdown) are service instances. 
{: note}

Use the following table to identify the platform role that you can grant a user in the IBM Cloud to run any of the following platform actions:


| Platform actions   | Administrator   | Editor | Operator | Viewer  |
|--------------------------|:--------------------------:|:-------:|:--------:|:------:|
| Grant other account members access to work with the service. | ![Checkmark icon.](images/confirm.png "Feature available") |         |          |        |
| Create a project.                                           | ![Checkmark icon.](images/confirm.png "Feature available") | ![Checkmark icon.](images/confirm.png "Feature available") |      |      |
| Delete a project.                                              | ![Checkmark icon.](images/confirm.png "Feature available") | ![Checkmark icon.](images/confirm.png "Feature available")    |        |      |
| Update a project.                                               | ![Checkmark icon.](images/confirm.png "Feature available")  | ![Checkmark icon.](images/confirm.png "Feature available")    |        |      |
| View Code Engine dashboard.  | ![Checkmark icon.](images/confirm.png "Feature available")  | ![Checkmark icon.](images/confirm.png "Feature available")    | ![Checkmark icon.](images/confirm.png "Feature available")      |        |
| View details of a project.                                      | ![Checkmark icon.](images/confirm.png "Feature available")  | ![Checkmark icon.](images/confirm.png "Feature available")    | ![Checkmark icon.](images/confirm.png "Feature available")      | ![Checkmark icon.](images/confirm.png "Feature available")    |
{: caption="IAM user platform roles and actions" caption-side="bottom"}


## IBM Cloud service roles
{: #service}

Use the following table to identify the service roles that you can grant a user to run any of the following service actions:

| Actions                                                          | Manager                                    | Writer                 | Reader |
|-------------------------------------------------------------------------|:-------------------------------------------------:|:-----------------------------------:|:------:|
| Create items within a project.                       | ![Checkmark icon.](images/confirm.png "Feature available") | ![Checkmark icon.](images/confirm.png "Feature available")                    |    |
| Update items within a project.                                                | ![Checkmark icon.](images/confirm.png "Feature available")      | ![Checkmark icon.](images/confirm.png "Feature available")                    |    |
| Delete items within a project.                                          | ![Checkmark icon.](images/confirm.png "Feature available")      | ![Checkmark icon.](images/confirm.png "Feature available")                    |    |
| List and view items within a project.                                           | ![Checkmark icon.](images/confirm.png "Feature available")      | ![Checkmark icon.](images/confirm.png "Feature available")                    | ![Checkmark icon.](images/confirm.png "Feature available")    |
{: caption="IAM service roles and actions" caption-side="bottom"}

## Code Engine CLI access requirements
{: #cli-access-req}

To work with a Code Engine project with the CLI, you must first target a resource group. To target a resource group with the CLI, you need Viewer access to the resource group.

## Code Engine container registry requirements
{: #container-registry-access-req}

For more information about Code Engine requirements for accessing images in a container registry, see [Accessing container registries](https://cloud.ibm.com/docs/codeengine?topic=codeengine-add-registry&format=markdown).

## Code Engine service binding access requirements
{: #service-binding-access-req}

For more information about Code Engine service binding access requirements, see [Configuring access for service bindings](https://cloud.ibm.com/docs/codeengine?topic=codeengine-configure-bindaccess&format=markdown).

## Code Engine access requirements for your toolchain
{: #toolchain-access-req}

For more information about Code Engine access requirements for building and deploying an app or job with a toolchain, see [Configuring access for your toolchain](https://cloud.ibm.com/docs/codeengine?topic=codeengine-toolchain-ce&format=markdown#permissions-toolchain).