--- name: containers-access-pod-identity title: Authorizing resources with IAM trusted profiles description: Learn how to setup access to or for your resources by using trusted profiles. last-updated: 2026-07-30 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Authorizing resources with IAM trusted profiles {: #pod-iam-identity} [Virtual Private Cloud]{: tag-vpc} [Classic infrastructure]{: tag-classic-inf} [Satellite]{: tag-satellite} Learn how to setup access to or for your resources by using trusted profiles. {: shortdesc} You can enable IAM trusted profiles by running the [`ibmcloud ks cluster master refresh`](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#cluster-master-refresh-cli) command. {: tip} In IAM : Start by creating an IAM trusted profile. Then, link the trusted profile with your IBM Cloud Kubernetes Service compute resource by selecting conditions to match with your clusters, including a Kubernetes namespace and service account in the clusters. Finally, assign access policies to the IBM Cloud services that you want your apps to use. In your cluster : Through [Kubernetes service account token volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection){: external}, the apps that run in your linked cluster's [Kubernetes namespace](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/){: external} and use the namespace's service account can exchange the service account public key to get an IBM Cloud IAM access token. Your app can use this access token to authenticate API requests to IBM Cloud services, such as databases, Watson, or VPC infrastructure. Through the access policies of the trusted profile, you control what actions the token lets the app perform. ## Creating an IAM trusted profile {: #iam-trusted-profile-create} To create a trusted profile in your account, see [Creating trusted profiles](https://cloud.ibm.com/docs/iam?topic=iam-create-trusted-profile&interface=ui&format=markdown) in the IAM documentation. Note that to create a trusted profile, you must be the account owner. Additionally, the following access roles are required. - Administrator role for all account management services. - Administrator role on the IAM Identity Service. For more information, see [IAM Identity Service](https://cloud.ibm.com/docs/iam?topic=iam-account-services&interface=ui&format=markdown#identity-service-account-management). - [Additional roles required for your specific resources and components](https://cloud.ibm.com/docs/containers?topic=containers-configure-trusted-profile&format=markdown#tp-minreqs-all). ## Set the default trusted profile for the cluster {: #iam-trusted-profile-set} To set a trusted profile for a single cluster, run the [`ibmcloud ks experimental trusted-profile set` command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#experimental-trusted-profile-set-cli). If you want all the clusters in a resource group to use the same trusted profile, run the [`ibmcloud ks experimental trusted-profile default set` command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#experimental-trusted-profile-default-set-cli). ## Get the details of your trusted profile {: #iam-trusted-profile-get} To get the default trusted profile for clusters in the same resource group, run the [`ibmcloud ks experimental trusted-profile default get` command](https://cloud.ibm.com/docs/containers?topic=containers-kubernetes-service-cli&format=markdown#experimental-trusted-profile-default-get-cli). ## Configure your application pods to authenticate with IBM Cloud services {: #iam-identity-pod} Give application pods that run in your IBM Cloud® Kubernetes Service cluster access to IBM Cloud services by using trusted profiles in IBM Cloud Identity and Access Management (IAM). As a developer, you can configure your application pods to authenticate with IBM Cloud services in clusters that are linked to an IAM trusted profile set up. {: shortdesc} To complete these steps, you do not need to have the administrator access role. However, you must meet the following requirements: **Viewer** [platform](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles&format=markdown) access role; **Writer** [service](https://cloud.ibm.com/docs/containers?topic=containers-iam-platform-access-roles&format=markdown) access role for the cluster in IBM Cloud IAM for **Kubernetes Service**; the `iam-identity.profile.create` and `iam-identity.profile.linkToResource` actions for the [IAM identity service](https://cloud.ibm.com/docs/iam?topic=iam-iam-service-roles-actions&format=markdown#iam-identity-roles). {: note} Before you begin: * [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster&format=markdown) * Make sure that your account administrator [created an IAM trusted profile for your cluster](https://cloud.ibm.com/docs/containers?topic=containers-pod-iam-identity&format=markdown#iam-trusted-profile-create). To configure your application pods to authenticate with IBM Cloud services: 1. Design your pod configuration file to use [service account token volume projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection){: external}. 1. In the `containers` section, mount the identity token in the `volumeMounts` section. ```yaml ... volumeMounts: - mountPath: /var/run/secrets/tokens name: sa-token ``` {: codeblock} 1. In the `volumes` section, set up the service account token volume projection. Modify the `expirationSeconds` field to control how long the token is valid for. To retrieve IAM tokens, the service account token expiration must be 1 hour or less. {: tip} ```yaml ... volumes: - name: sa-token projected: sources: - serviceAccountToken: path: sa-token expirationSeconds: 3600 audience: iam ... ``` {: codeblock} 1. Design your app to exchange the service account projected token for an IAM token that you can use for subsequent API calls to IBM Cloud services. Review the following example authentication request. Replace `${profile_id}` with the ID of the trusted profile that the cluster is linked to. To list available profile IDs, you or the account administrator can use the `ibmcloud iam tps` command, the `GET 'https://iam.cloud.ibm.com/v1/profiles/?account_id='`, or you can view the trusted profiles in the [IAM console](https://cloud.ibm.com/iam/trusted-profiles/){: external}. ```sh curl -s -X POST \ -H "Content-Type: application/x-www-form-urlencoded" \ -H "Accept: application/json" \ -d grant_type=urn:ibm:params:oauth:grant-type:cr-token \ -d cr_token=$(cat /var/run/secrets/tokens/sa-token) \ -d profile_id=${profile_id} \ https://iam.cloud.ibm.com/identity/token ``` {: codeblock} 1. Before your app is deployed, try the following example Kubernetes job to test the token exchange. In the following Kubernetes job, a `curl` pod makes an API request to IBM Cloud IAM to verify that the cluster's public key is exchanged for an IAM access token. Your app might call other IBM Cloud services that the trusted profile authorizes. ```yaml apiVersion: batch/v1 kind: Job metadata: name: token-exchange-job namespace: default spec: template: spec: containers: - name: curl image: curlimages/curl:7.77.0 command: ["/bin/sh"] args: ["-c", "curl -s -H \"Content-Type: application/x-www-form-urlencoded\" -H \"Accept: application/json\" -d grant_type=urn:ibm:params:oauth:grant-type:cr-token -d cr_token=$(cat /var/run/secrets/tokens/sa-token) -d profile_id= https://iam.cloud.ibm.com/identity/token"] volumeMounts: - mountPath: /var/run/secrets/tokens name: sa-token restartPolicy: Never serviceAccountName: default volumes: - name: sa-token projected: sources: - serviceAccountToken: path: sa-token expirationSeconds: 3600 audience: iam ``` {: codeblock} 1. Deploy the job. ```sh kubectl apply -f exchange-job.yaml ``` {: pre} 1. Review the job details to verify it was successful. ```sh kubectl describe job token-exchange-job ``` {: pre} 1. Review the output for the `job completed` and `succeeded` messages to verify the job was a success. 1. If the job succeeded, check your Activity Tracker global events in Frankfurt to verify the log line with details on the Trusted Profile request. If the job failed, review your configuration and try again.