Assigning access to resources in the console

To assign access to an individual resource in the account or access to all resources in the account, complete the following steps:

1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Manage > Access (IAM), and select Service IDs, depending on which identity you want to assign access.
2. Click the Actions icon > Assign access for the user or service ID that you want to assign access.
3. Select a group of services or a single service. Then, click Next.
4. Scope the access to the all resources in the account, or select specific resources based on attributes.
5. Click Next.
6. Select any combination of roles to assign, and click Review.
7. Click Add to add your policy configuration to your policy summary.
8. (Optional) Add users or service IDs to Access groups.
   1. Select the access groups that you want the user or service ID to belong to.
   2. Click Add
9. Click Assign.

If a user doesn't have a role on the resource group that contains the resources, they can see the resources, but can't access the resources by going to the Resource list page in the account to start working with them. Assign the Viewer role or higher on the resource group itself to ensure that a user can access the resource.

Increased policy limits for service IDs are available for select accounts. To take advantage of the increased policy limits, assign access to Event Streams or IBM Cloud Object Storage services. You must also scope the access policies to a specific service instance, resource type, and resource ID.

Assigning access within a resource group in the console

To assign access to all resources in a resource group or to just one service within a resource group, complete the following steps:

1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to assign access.
2. Click the user or service ID that you want to assign access, then click Access > Assign access.
3. Select a group of services or a single service. Then, click Next.
4. Scope the access to Specific resources. Select the Resource group attribute type and enter a resource group.
5. Click Next.
6. Select the access roles to manage the resource group. Then, click Next.
7. Select any combination of roles to assign, and click Review.
8. Click Add to add your policy configuration to your policy summary.
9. Click Assign.

Assigning access to manage a resource group

You can assign access to view or manage a resource group without assigning service access.

As an administrator, you might want to create an access group with the Viewer role on all resource groups. This way, when you assign access to service resources you don’t have to create additional policies for viewing resource groups. The Viewer role on a resource group is required for a user to create a service instance in that resource group.

To assign access to a resource group without assigning service access, complete the following steps:

1. In the IBM Cloud console, click Manage > Access (IAM), and select Users or Service IDs, depending on which identity you want to assign access.
2. Click the user or service ID that you want to assign access, then click Access > Assign access.
3. Select Resource group only.
4. Select Add a condition.
5. Select the Resource group attribute type and enter a resource group.
6. Click Next.
7. Select the access roles for viewing or managing the resource group. Then, click Review.
8. Click Add to add your policy configuration to your policy summary.
9. Click Assign.

You can repeat this type of policy as needed for each available resource group in the account to assign access to manage all resource groups in the account.

Assigning access to InstructLab by using the CLI

For step-by-step instructions for assigning, removing, and reviewing access, see Assigning access to resources by using the CLI. The following example shows a command for assigning the Writer role for instructlab:

Use instructlab for the service name. To find the role IDs, run the ibmcloud iam roles command. Also, use quotations around role names that are more than one word. For example "Service Configuration Reader".

Example command to give a user the Viewer role for a specific InstructLab project in the account.

ibmcloud iam user-policy-create name@example.com --roles Viewer --service-name instructlab --attributes "projectId=1b111111-1ef1-11f1-1111-111bae11111a"

Example command to give a user the Key Manager role for a specific InstructLab project in the account.

ibmcloud iam user-policy-create name@email.com --roles "Key Manager" --service-name instructlab

Example command to give a user the Writer role for all InstructLab projects in the account.

ibmcloud iam user-policy-create USER@EXAMPLE.COM --service-name instructlab --roles Writer

Example command to assign the Administrator role for all instances of InstructLab service in the account.

ibmcloud iam user-policy-create name@example.com --roles Administrator --service-name instructlab

Example command to assign the Viewer role to all resource groups in the account.

ibmcloud iam user-policy-create name@example.com --roles Viewer --resource-type resource-group

Example command to assign the Viewer role to all users in a specific resource group.

ibmcloud iam user-policy-create name@example.com --roles Viewer --resource-type resource-group

Example command to get a resource group the Administrator role.

ibmcloud iam service-policy-create test --roles Administrator --resource-group-name sample-resource-group

Assigning user access to InstructLab by using the API

For step-by-step instructions for assigning, removing, and reviewing access, see Assigning access to resources by using the API or the Create a policy API docs. Role cloud resource names (CRN) in the following table are used to assign access with the API.

Use instructlab for the service name, and refer to the Role CRN values table to ensure that you're using the correct value for the role. Review the following list of role CRNs.

The following example assigns the Writer role for instructlab.

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
  "type": "access",
  "description": "Writer role for InstructLab",
  "subjects": [
    {
      "attributes": [
        {
          "name": "iam_id",
          "value": "IBMid-123453user"
        }
      ]
    }'
  ],
  "roles":[
    {
      "role_id": "crn:v1:bluemix:public:iam::::serviceRole:Writer"
    }
  ],
  "resources":[
    {
      "attributes": [
        {
          "name": "accountId",
          "value": "$ACCOUNT_ID"
        },
        {
          "name": "serviceName",
          "value": "instructlab"
        }
      ]
    }
  ]
}

Assigning access to resources by using the API

You can assign access to an individual resource in the account or access to a list of resources in the account by calling the IBM Cloud® Identity and Access Management (IAM) Policy Management API as shown in the following sample request. The sample request gives Administrator role access for an instance of a service:

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' \
-H 'Content-Type: application/json' -d '{
  "type": "access",
  "description": "Administrator role for SERVICE_NAME's RESOURCE_NAME",
  "subjects": [
    {
      "attributes": [
        {
          "name": "iam_id",
          "value": "IBMid-123453user"
        }
      ]
    }'
  ],
  "roles":[
    {
      "role_id": "crn:v1:bluemix:public:iam::::role:Administrator"
    }
  ],
  "resources":[
    {
      "attributes": [
        {
          "name": "accountId",
          "value": "$ACCOUNT_ID"
        },
        {
          "name": "serviceName",
          "value": "$SERVICE_NAME"
        },
        {
          "name": "resource",
          "value": "$RESOURCE_NAME",
          "operator": "stringEquals"
        }
      ]
    }
  ]
}'

SubjectAttribute subjectAttribute = new SubjectAttribute.Builder()
      .name("iam_id")
      .value("EXAMPLE_USER_ID")
      .build();

PolicySubject policySubjects = new PolicySubject.Builder()
      .addAttributes(subjectAttribute)
      .build();

PolicyRole policyRoles = new PolicyRole.Builder()
      .roleId("crn:v1:bluemix:public:iam::::role:Administrator")
      .build();

ResourceAttribute accountIdResourceAttribute = new ResourceAttribute.Builder()
      .name("accountId")
      .value(exampleAccountId)
      .operator("stringEquals")
      .build();

ResourceAttribute serviceNameResourceAttribute = new ResourceAttribute.Builder()
      .name("serviceName")
      .value("service")
      .operator("stringEquals")
      .build();

PolicyResource policyResources = new PolicyResource.Builder()
      .addAttributes(accountIdResourceAttribute)
      .addAttributes(serviceNameResourceAttribute)
      .build();

CreatePolicyOptions options = new CreatePolicyOptions.Builder()
      .type("access")
      .subjects(Arrays.asList(policySubjects))
      .roles(Arrays.asList(policyRoles))
      .resources(Arrays.asList(policyResources))
      .build();

Response<Policy> response = service.createPolicy(options).execute();
Policy policy = response.getResult();

System.out.println(policy);

const policySubjects = [
  {
    attributes: [
      {
        name: 'iam_id',
        value: 'exampleUserId',
      },
    ],
  },
];
const policyRoles = [
  {
    role_id: 'crn:v1:bluemix:public:iam::::role:Administrator',
  },
];
const accountIdResourceAttribute = {
  name: 'accountId',
  value: exampleAccountId,
  operator: 'stringEquals',
};
const serviceNameResourceAttribute = {
  name: 'serviceName',
  value: 'service',
  operator: 'stringEquals',
};
const policyResources = [
  {
    attributes: [accountIdResourceAttribute, serviceNameResourceAttribute]
  },
];
const params = {
  type: 'access',
  subjects: policySubjects,
  roles: policyRoles,
  resources: policyResources,
};

iamPolicyManagementService.createPolicy(params)
  .then(res => {
    examplePolicyId = res.result.id;
    console.log(JSON.stringify(res.result, null, 2));
  })
  .catch(err => {
    console.warn(err)
  });

policy_subjects = PolicySubject(
  attributes=[SubjectAttribute(name='iam_id', value='example_user_id')])
policy_roles = PolicyRole(
  role_id='crn:v1:bluemix:public:iam::::role:Administrator')
account_id_resource_attribute = ResourceAttribute(
  name='accountId', value=example_account_id)
service_name_resource_attribute = ResourceAttribute(
  name='serviceName', value='service')
policy_resources = PolicyResource(
  attributes=[account_id_resource_attribute,
        service_name_resource_attribute])

policy = iam_policy_management_service.create_policy(
  type='access',
  subjects=[policy_subjects],
  roles=[policy_roles],
  resources=[policy_resources]
).get_result()

print(json.dumps(policy, indent=2))

subjectAttribute := &iampolicymanagementv1.SubjectAttribute{
  Name:  core.StringPtr("iam_id"),
  Value: core.StringPtr("exampleUserID"),
}
policySubjects := &iampolicymanagementv1.PolicySubject{
  Attributes: []iampolicymanagementv1.SubjectAttribute{*subjectAttribute},
}
policyRoles := &iampolicymanagementv1.PolicyRole{
  RoleID: core.StringPtr("crn:v1:bluemix:public:iam::::role:Administrator"),
}
accountIDResourceAttribute := &iampolicymanagementv1.ResourceAttribute{
  Name:     core.StringPtr("accountId"),
  Value:    core.StringPtr(exampleAccountID),
  Operator: core.StringPtr("stringEquals"),
}
serviceNameResourceAttribute := &iampolicymanagementv1.ResourceAttribute{
  Name:     core.StringPtr("serviceName"),
  Value:    core.StringPtr("service"),
  Operator: core.StringPtr("stringEquals"),
}
policyResources := &iampolicymanagementv1.PolicyResource{
  Attributes: []iampolicymanagementv1.ResourceAttribute{
    *accountIDResourceAttribute, *serviceNameResourceAttribute}
}

options := iamPolicyManagementService.NewCreatePolicyOptions(
  "access",
  []iampolicymanagementv1.PolicySubject{*policySubjects},
  []iampolicymanagementv1.PolicyRole{*policyRoles},
  []iampolicymanagementv1.PolicyResource{*policyResources},
)

policy, response, err := iamPolicyManagementService.CreatePolicy(options)
if err != nil {
  panic(err)
}
b, _ := json.MarshalIndent(policy, "", "  ")
fmt.Println(string(b))

You can assign access to a group of services. To assign access to All Identity and Access enabled services, specify serviceType for the name attribute, and use the value service. To assign access to All Account Management services, specify serviceType for the name attribute, and use the value platform_service. To assign access to the subset of account management services All IAM Account Management services, specify service_group_id for the name attribute, and use the value IAM.

Increased policy limits for service IDs are available for select accounts. To take advantage of the increased policy limits, assign access to Event Streams or IBM Cloud Object Storage services. You must also scope the access policies to a specific service instance, resource type, and resource ID.

The following sample request gives a service ID Reader role access to an instance of Object Storage. It scopes the access to a specific service instance, resource type, and resource ID:

curl -X POST 'https://iam.cloud.ibm.com/v1/policies' -H 'Authorization: Bearer $TOKEN' -H 'Content-Type: application/json' -d '{
  "type": "access",
  "description": "Reader role for SERVICE_NAME's RESOURCE_NAME",
  "subjects": [
    {
      "attributes": [
        {
          "name": "iam_id",
          "value": "$SERVICE_ID"
        }
      ]
    }'
  ],
  "roles":[
    {
      "role_id": "crn:v1:bluemix:public:iam::::serviceRole:Reader"
    }
  ],
  "resources":[
    {
      "attributes": [
        {
          "name": "accountId",
          "value": "$ACCOUNT_ID"
        },
        {
          "name": "serviceName",
          "value": "cloud-object-storage"
        },,
        {
          "name": "serviceInstance",
          "value": "$INSTANCE_ID",
          "operator": "stringEquals"
        }
        {
          "name": "resourceType",
          "value": "$RESOURCE_TYPE",
          "operator": "stringEquals"
        },
        {
          "name": "resource",
          "value": "$RESOURCE_NAME",
          "operator": "stringEquals"
        }
      ]
    }
  ]
}'

Assigning access within a resource group by using the API

This action can be done only through the UI or CLI. To see the steps, switch to the UI or CLI instructions.