Managing users and roles

Create a user with RBAC roles through the API

To create a user using RBAC roles, use a command like:

Create User

POST /deployments/{id}/users/{user_type}
{
  "user": {
  "username": "#{USER}",
  "password": "<PASSWORD>",
  "role": "<+/-@all> <+/-@read> <+/-@write> <+/-@admin>"
  }
}

Create a user with RBAC roles through the CLI

To create a user using RBAC roles, use a command like:

ibmcloud cdb deployment-user-create <CRN_NAME> <USERNAME> <PASSWORD> -r "+@read +@write"

For -r USER_ROLE, use some combination of <+/-@all> <+/-@read> <+/-@write> <+/-@admin> to grant access.

Once the task is finished, retrieve the new user's connection strings with the ibmcloud cdb deployment-connections command.

Create a user with RBAC roles through Terraform

To create a user using RBAC roles, use a configuration like:

resource "ibm_database" "redis" {
  name = "example-redis"
  plan = "standard"
  location = "us-south"
  service = "databases-for-redis"
  resource_group_id = data.ibm_resource_group.group.id
  tags = ["tag1", "tag2"]
  version = "6"

  users {
    name = "<user_name>"
    password = "securepassword123"
    role = "-@all +@read"
  }
}

For role, use some combination of <+/-@all> <+/-@read> <+/-@write> <+/-@admin> to grant access.

Creating users through the UI

1. Navigate to the service dashboard for your service.
2. Select Service Credentials.
3. Select New Credential.
4. Choose a descriptive name for your new credential.
5. (Optional) Specify whether the new credentials use a public or private endpoint. Use either { "service-endpoints": "public" } / { "service-endpoints": "private" } in the Add Inline Configuration Parameters field to generate connection strings using the specified endpoint. Use of the endpoint is not enforced. It just controls which hostnames are in the connection strings. Public endpoints are generated by default.
6. Click Add to provision the new credentials. A username, password, and an associated user are auto-generated.

The new credentials appear in the table, and the connection strings are available as JSON in a click-to-copy field under View Credentials.

Creating users from the API

The Foundation Endpoint that is shown in the Overview of your service provides the base URL to access this instance through the API. To create and manage users, use the base URL with the users endpoint:

curl -X POST https://api.{region}.databases.cloud.ibm.com/v5/ibm/deployments/{id}/users/{user_type} \
-H "Authorization: Bearer $APIKEY" \ 
-H "Content-Type: application/json" \
-d "{"user": {"username": "user", "password": "v3ry-1-secUre-pAssword-2"}}" \

To retrieve a user's connection strings, use the base URL with the /users/{userid}/connections endpoint.