---
name: event-notifications-en-iam-authorization
title: Authorizing Event Notifications to access other services
description: Use IBM Cloud® Identity and Access Management (IAM) to create or remove an authorization that grants one service access to another service. You must grant Event Notifications the appropriate IAM service to service access for it to be able to send notifications and alerts to the various available destinations. You can find the list of available destinations here.
last-updated: 2026-03-27
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/event-notifications?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Authorizing Event Notifications to access other services
{: #en-using-s2s-authorization}

Use IBM Cloud® Identity and Access Management (IAM) to create or remove an authorization that grants one service access to another service. You must grant Event Notifications the appropriate IAM service to service access for it to be able to send notifications and alerts to the various available destinations. You can find the list of available destinations [here](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-destination&format=markdown).

If the source service that needs access to the target service is in the same account, select **This account**. The service-to-service authorization is created when the integration is created from the console. If the integration is being created by using the API, the users need to create the service-to-service authorization manually.
{: note}

## Creating an authorization in the console
{: #en-using-s2s-console}

If the source and target services are in different accounts or if the authorization is created manually, complete the following steps: 

1. In the IBM Cloud console, click **Manage** > **Access (IAM)**, and select **Authorizations**.

1. Click **Create**.

1. Select a source account.

1. Select the **Source service** as **Event Notifications**.

1. Specify whether you want to authorize all Event Notifications resources, specific resource group, resource ID, or a service instance. If you select specific resource group, resource ID, or a service instance you need specify the resource group,resource ID or service instance under **Add a condition**.

1. Select a **Target service**.

1. For the target service, specify whether you want to give Event Notifications access to all resources of the target, only to a specific resource group, a region, a service instance, a resource type or a resource ID. 

1. Select the appropriate roles to grant Event Notifications access to the target service.

1. Click **Authorize**.
{: ui}


To authorize a source service to access a target service, run the `ibmcloud iam authorization-policy-create` command.

For more information about all the parameters available for this command, see [ibmcloud iam authorization-policy-create](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam&format=markdown#ibmcloud_iam_authorization_policy_create).
{: cli}

You can use the [Terraform IBM Modules (TIM) for service to service authorization](https://registry.terraform.io/modules/terraform-ibm-modules/s2s-auth/ibm/latest){: external} to create authorization policies between Event Notifications and other services.

An example for service to service authorization using Terraform IBM Modules (TIM):

```terraform
module "service_auth" {
  source                = "terraform-ibm-modules/s2s-auth/ibm"
  version               = "2.0.7"
  enable_cbr            = false
  service_map           = {
    "test-policy-1" = {
      "description"              = "This is a test auth policy",
      "enforcement_mode"         = "report",
      "roles"                    = ["Reader"],
      "source_resource_instance_id" = "<source_resource_instance_guid>",
      "source_service_name"      = "cloud-object-storage",
      "target_resource_instance_id" = "<target_resource_instance_guid>",
      "target_service_name"      = "kms"
    }
  }
}
```
{: codeblock}