---
name: framework-financial-services-shared-account-access-management
title: Access management in IBM Cloud
description: After deciding how to organize your accounts and resources, you will need to properly manage access for deployments of the reference architectures that will help achieve separation of duties and least privilege.
last-updated: 2025-02-20
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/framework-financial-services?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Access management in IBM Cloud
{: #shared-account-access-management}



After deciding how to [organize your accounts and resources](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-account-organization&format=markdown), you will need to properly manage access for deployments of the reference architectures that will help achieve [separation of duties and least privilege](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practices&format=markdown#best-practices-zero-trust).
{: shortdesc}

## Managing access with access groups
{: #access-groups}

An [access group](https://cloud.ibm.com/docs/account?topic=account-groups&format=markdown) is a grouping of user and service IDs to which the same IAM access can be granted. You can assign a single policy to the group instead of assigning the same access multiple times per individual user or service ID. A logical way to assign access is by creating one access group per wanted level of access.

Always use access groups for managing access. IAM policies should never be attached directly to users.
{: important}

For more information:

* [IAM access](https://cloud.ibm.com/docs/account?topic=account-userroles&format=markdown) for definitions of platform management roles and service access roles.
* [Giving access to resources in resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs_manage_access&format=markdown)
* [Best practices for assigning access](https://cloud.ibm.com/docs/account?topic=account-account_setup&format=markdown) for more details about working with IAM.

You must determine what set of access groups works well for your situation. Whatever structure you choose, repeat it for every account (whether a stand-alone account or part of an enterprise).

### Example access group structure
{: #example-structure}

For illustration, the following table shows one possible setup that provides for a reasonable separation of duties.



| Access Group | Description |
| --- | --- |
| cloud-organization-admins | Responsible for organizing the structure of the resources used by the organization. |
| cloud-network-admins | Responsible for creating networks, VPCs, load balancers, subnets, firewall rules, and network devices. |
| cloud-security-admins | Responsible for establishing and managing security policies for the entire organization, including access management and organization constraint policies. |
| cloud-billing-admins | Responsible for setting up billing accounts and monitoring their usage. |
| cloud-devops | DevOps practitioners create or manage end-to-end pipelines that support continuous integration and delivery, monitoring, and system provisioning. |
| cloud-developers | Developers are responsible for designing, coding, and testing applications. |
{: caption="Access groups" caption-side="bottom"}

After the access groups are created, you can assign roles to them.



Never assign roles directly to users. Assign roles to access groups only.
{: tip}

For more information, see:

* [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions&format=markdown) for a list of applicable roles for every IBM Cloud service
* [Access management in IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-cloudaccess&format=markdown)

## Invite users to your account
{: #invite-users}

After you have access groups in place, then you can start inviting users to your account and assigning them to the appropriate access group depending on their job responsibilities. For more information, see [Inviting users to an account](https://cloud.ibm.com/docs/account?topic=account-iamuserinv&format=markdown).





## Access groups with dynamic rules
{: #dynamic-rules}

If you're using an external identity provider, dynamic rules allow you to automatically add federated users to an access group based on SAML assertions. When a user logs in with a federated ID, the data that is provided by your identity provider dynamically maps the user to an access group based on the rules that you set. This can dramatically ease the administration of your account.

For more information see:

1. [Creating dynamic rules for access groups](https://cloud.ibm.com/docs/account?topic=account-rules&format=markdown)

## Considerations for enterprises
{: #enterprise}

If you're using an enterprise, these resources provide additional information:

* [Setting up an enterprise](https://cloud.ibm.com/docs/enterprise-management?topic=enterprise-management-enterprise-tutorial&format=markdown)

## Required permissions for services in reference architecture
{: #required-permissions}

The following table provides references to additional information for managing access with IAM for each service in the reference architectures.

| Category | VPC reference architecture | Satellite reference architecture | Optional for both |
|----------|-------------------|-------------------|-------------------|
| Core  | - [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started&interface=ui&format=markdown) [^tabletext] | - [Satellite](https://cloud.ibm.com/docs/satellite?topic=satellite-iam&format=markdown) |  |
| Containers  | - [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/openshift?topic=openshift-iam-platform-access-roles&format=markdown) \n - [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&format=markdown) | - [Red Hat OpenShift on IBM Cloud](https://cloud.ibm.com/docs/satellite?topic=satellite-iam&format=markdown#iam-roles-clusters) [^tabletext-satellite-enabled-openshift] \n - [Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&format=markdown) |  |
| Networking | - [VPC infrastructure services](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started&interface=ui&format=markdown) \n - [Direct Link](https://cloud.ibm.com/docs/dl?topic=dl-iam&format=markdown) \n - [Transit Gateway](https://cloud.ibm.com/docs/transit-gateway?topic=transit-gateway-iam&format=markdown)| |  |
| Storage  | - [Block Storage for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started&interface=ui&format=markdown) \n - [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam&format=markdown) | - [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam&format=markdown) |  |
| Security  | - [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access&format=markdown) | - [Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-access&format=markdown)  | - [App ID](https://cloud.ibm.com/docs/appid?topic=appid-service-access-management&format=markdown) |
| Logging and monitoring  | - [Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-iam&format=markdown) \n - [Compliance Manager](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-access-management&format=markdown) \n - [Flow Logs for VPC](https://cloud.ibm.com/docs/vpc?topic=vpc-iam-getting-started&interface=ui&format=markdown) | - [Activity Tracker Event Routing](https://cloud.ibm.com/docs/atracker?topic=atracker-iam&format=markdown) \n [Compliance Manager](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-access-management&format=markdown) |  |
| Integration  | | | - [Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security&format=markdown) |
{: caption="Managing access for IBM Cloud services in the reference architectures" caption-side="top"}

[^tabletext]: Only required if enabling public internet access to workload VPC for application consumers.

[^tabletext-satellite-enabled-openshift]: {{site.data.content.satellite-enabled-openshift}}

## Related controls in IBM Cloud Framework for Financial Services
{: #related-controls}

{{site.data.content.related-controls-disclaimer}}

| Family              | Control                                           |
|---------------------|---------------------------------------------------|
| Access Control (AC) | [AC-3 Access Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-3&format=markdown) \n [AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-5&format=markdown) \n [AC-6 Least Privilege](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ac-6&format=markdown) |
{: caption="Related controls in IBM Cloud Framework for Financial Services [FSv2.0]" caption-side="top"}
{: #related-controls-fsv2.0}
{: tab-title="FSv2.0"}
{: tab-group="RelatedControls-1"}
{: class="simple-tab-table"}


| Family              | Control                                           |
|---------------------|---------------------------------------------------|
| Access Control (AC) | [AC-3 Access Enforcement](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-3&format=markdown) \n [AC-5 Separation of Duties](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-5&format=markdown) \n [AC-6 Least Privilege](https://cloud.ibm.com/docs/framework-financial-services-controls-fsv1-1?topic=framework-financial-services-controls-fsv1-1-ac-6&format=markdown) |
{: caption="Related controls in IBM Cloud Framework for Financial Services [FSv1.1]" caption-side="top"}
{: #related-controls-fsv1.1}
{: tab-title="FSv1.1"}
{: tab-group="RelatedControls-1"}
{: class="simple-tab-table"}


## Next steps
{: #next-steps}

* [Handling and securing secrets](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-shared-secrets&format=markdown)