---
name: secrets-manager-cbr-control-access
title: Protecting Secrets Manager resources with context-based restrictions
description: With context-based restrictions, you can define and enforce user and service access restrictions to Secrets Manager resources based on specified criteria.
last-updated: 2026-10-05
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/secrets-manager?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

{:codeblock: .codeblock}
{:screen: .screen}
{:download: .download}
{:external: target="_blank" .external}
{:faq: data-hd-content-type='faq'}
{:gif: data-image-type='gif'}
{:important: .important}
{:note: .note}
{:pre: .pre}
{:tip: .tip}
{:preview: .preview}
{:deprecated: .deprecated}
{:beta: .beta}
{:term: .term}
{:shortdesc: .shortdesc}
{:script: data-hd-video='script'}
{:support: data-reuse='support'}
{:table: .aria-labeledby="caption"}
{:troubleshoot: data-hd-content-type='troubleshoot'}
{:help: data-hd-content-type='help'}
{:tsCauses: .tsCauses}
{:tsResolve: .tsResolve}
{:tsSymptoms: .tsSymptoms}
{:video: .video}
{:step: data-tutorial-type='step'}
{:tutorial: data-hd-content-type='tutorial'}
{:api: .ph data-hd-interface='api'}
{:cli: .ph data-hd-interface='cli'}
{:ui: .ph data-hd-interface='ui'}
{:terraform: .ph data-hd-interface="terraform"}
{:curl: .ph data-hd-programlang='curl'}
{:java: .ph data-hd-programlang='java'}
{:ruby: .ph data-hd-programlang='ruby'}
{:c#: .ph data-hd-programlang='c#'}
{:objectc: .ph data-hd-programlang='Objective C'}
{:python: .ph data-hd-programlang='python'}
{:javascript: .ph data-hd-programlang='javascript'}
{:php: .ph data-hd-programlang='PHP'}
{:swift: .ph data-hd-programlang='swift'}
{:curl: .ph data-hd-programlang='curl'}
{:dotnet-standard: .ph data-hd-programlang='dotnet-standard'}
{:go: .ph data-hd-programlang='go'}
{:unity: .ph data-hd-programlang='unity'}
{:release-note: data-hd-content-type='release-note'}


# Protecting Secrets Manager resources with context-based restrictions
{: #access-control-cbr}

After you set up your IBM Cloud® Secrets Manager service instance, you can manage access by using [context-based restrictions (CBR)](https://cloud.ibm.com/context-based-restrictions/overview){: external}.


## Managing CBR settings
{: #manage-cbr-settings}

With [context-based restrictions](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-create&format=markdown), you can define and enforce user and service access restrictions to Secrets Manager resources based on specified criteria.
{: shortdesc}

You can control Secrets Manager resources with context-based restrictions and identity and access management (IAM) policies. These restrictions work with traditional IAM policies, which are based on identity, to provide another layer of protection. For more information, see [What are context-based restrictions](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-whatis&format=markdown).

A user must have the `Administrator` role on the Secrets Manager service to create, update, or delete rules. A user must also have either the `Editor` or `Administrator` role on the context-based restrictions service to create, update, or delete network zones. A user with the `Viewer` role on the context-based restrictions service can add only network zones to a rule.
{: note}

Any IBM Cloud Activity Tracker or audit log events that are generated come from the context-based restrictions service, not Secrets Manager. For more information, see [Monitoring context-based restrictions](https://cloud.ibm.com/docs/iam?topic=iam-cbr-monitor&format=markdown).

To get started with protecting your Secrets Manager resources with context-based restrictions, see the tutorial for [Leveraging context-based restrictions to secure your resources](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-tutorial&format=markdown).

## How Secrets Manager integrates with context-based restrictions
{: #cbr-overview}

You can create context-based restrictions (CBR) for Secrets Manager service APIs and platform APIs. With context-based restrictions, you can protect the following API types.

Trial and Standard APIs
:   Protect access to the APIs used by applications and clients to manage and access standard Secrets Manager resources and perform secret management operations. For example, you can protect the APIs used to manage secret groups, configurations, and notifications registrations, as well as the APIs used to create, read, rotate, or lock secrets and their versions. This API type applies only to instances on the [Trial and Standard]{: tag-blue} plans.

Vault Dedicated management APIs
:   Protect access to the APIs used by applications and clients to manage, configure, and perform administrative operations on Vault Dedicated resources. For example, you can protect the APIs used for admin token creation and revocation. This API type applies only to instances on the [Vault Dedicated]{: tag-green} plan.

Vault Dedicated runtime APIs
:   Protect access to the APIs used by applications and clients to access and consume Vault Dedicated resources during runtime. This API type applies only to instances on the [Vault Dedicated]{: tag-green} plan.

Platform APIs — Resource management
:   Protect access to the platform-level APIs used to manage the lifecycle of your Secrets Manager service instance, such as provisioning, de-provisioning, and managing resource keys and bindings.

To restrict access, you must create [zones](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-create&interface=ui&format=markdown#network-zones-create) and [rules](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-create&interface=ui&format=markdown#context-restrictions-create-rules). After you create or update a zone or a rule, it might take a few minutes for the change to take effect.

### Protecting specific APIs
{: #cbr-specific-apis}

You can create CBR rules to protect the following API types for Secrets Manager.

#### Trial and Standard APIs
{: #cbr-api-type-standard}

Trial and Standard APIs are used by applications and clients to manage and access Secrets Manager resources and perform secret management operations.

CBR rules that apply to the Trial and Standard API type control access to secret management and service administration operations, which include managing secret groups, configurations, destinations, and notifications registrations, viewing instance details and endpoints, and creating, reading, rotating, importing, revoking, and deleting secrets and their versions, managing secret version data, metadata, and policies, and managing locks on secrets and secret versions.

This API type applies only to Secrets Manager instances on the [Trial and Standard]{: tag-blue} plans.
{: note}

If you use the CLI, you can specify the `--api-types` option and the `crn:v1:bluemix:public:secrets-manager::::api-type:standard` type.

If you use the API, you can specify `"api_type_id": "crn:v1:bluemix:public:secrets-manager::::api-type:standard"` in the `"operations"` spec.

#### Vault Dedicated management APIs
{: #cbr-api-type-vault-dedicated-management}

[Vault Dedicated]{: tag-green} plan management APIs are used by applications and clients to manage, configure, and perform administrative operations on Vault Dedicated resources.

CBR rules that apply to the Vault Dedicated management API type control access to Vault Dedicated administration operations, configuration operations, which include admin token creation and revocation.

This API type applies only to Secrets Manager instances on the [Vault Dedicated]{: tag-green} plan.
{: note}

If you use the CLI, you can specify the `--api-types` option and the `crn:v1:bluemix:public:secrets-manager::::api-type:vault-dedicated-management` type.

If you use the API, you can specify `"api_type_id": "crn:v1:bluemix:public:secrets-manager::::api-type:vault-dedicated-management"` in the `"operations"` spec.

#### Vault Dedicated runtime APIs
{: #cbr-api-type-vault-dedicated-runtime}

Protect access to the APIs used by applications and clients to access and consume Vault Dedicated resources during runtime.

This API type applies only to Secrets Manager instances on the [Vault Dedicated]{: tag-green} plan.
{: note}

If you use the CLI, you can specify the `--api-types` option and the `crn:v1:bluemix:public:secrets-manager::::api-type:vault-dedicated-runtime` type.

If you use the API, you can specify `"api_type_id": "crn:v1:bluemix:public:secrets-manager::::api-type:vault-dedicated-runtime"` in the `"operations"` spec.

#### Platform APIs — Resource management
{: #cbr-api-type-resource-management}

Protect access to the platform-level APIs used to manage the lifecycle of your Secrets Manager service instance.

If you use the CLI, you can specify the `--api-types` option and the `crn:v1:bluemix:public:secrets-manager::::api-type:platform-resource-management` type.

If you use the API, you can specify `"api_type_id": "crn:v1:bluemix:public:secrets-manager::::api-type:platform-resource-management"` in the `"operations"` spec.

## Creating network zones
{: #cbr-network-zones}

To create network zones, follow the steps in [Creating context-based restrictions](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-create&format=markdown). When you add Secrets Manager as a service reference to a network zone, use `secrets-manager` as the `serviceRef` value.

The `serviceRef` attribute for Secrets Manager is `secrets-manager`.
{: tip}

Make sure to add Secrets Manager to network zones for rules that target other IBM Cloud resources, or some operations in your workflow might fail.
{: important}

## Understanding rules
{: #cbr-rules}

To create rules, follow the steps in [Creating context-based restrictions](https://cloud.ibm.com/docs/iam?topic=iam-context-restrictions-create&format=markdown). When you create a rule for Secrets Manager, select **Secrets Manager** as the service, then choose the API types you want to protect under **Service APIs** or **Platform APIs**:

**Service APIs**
- **Standard and Trial** — Applies only to instances on the [Trial and Standard]{: tag-blue} plans.
- **Vault Dedicated Management** — Applies only to Management API's of instances on the [Vault Dedicated]{: tag-green} plan.
- **Vault Dedicated Runtime** — Applies only to Runtime API's of instances on the [Vault Dedicated]{: tag-green} plan.

**Platform APIs**
- **Resource Management** - Applies only to Resource Controller and Global Search APIs.

## Limitations
{: #cbr-limitations}

Review the following limitations before you create CBR rules for Secrets Manager.

**Secret group rules require group-level IAM access**
:   When a user has instance-level IAM access, CBR rules that are applied to specific secret groups do not take effect. To work around this limitation, set the user's IAM access policies to only secret groups.

**CBR rules do not apply to provisioning or de-provisioning**
:   CBR rules do not restrict provisioning or de-provisioning operations. Use IAM policies to control who can create or delete Secrets Manager instances.

**Some platform API actions are not protected**
:   Context-based restrictions protect actions associated with the [Secrets Manager API](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2) and the Resource Management API type. The following platform API actions are not protected by context-based restrictions. Refer to the API docs for the specific action IDs.
   - [Resource instance APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controller)
   - [Resource keys APIs](https://cloud.ibm.com/apidocs/resource-controller/resource-controller)
   - [IAM policy APIs](https://cloud.ibm.com/apidocs/iam-policy-management#list-policies)
   - [Global search APIs](https://cloud.ibm.com/apidocs/search)
   - Global tagging [Attach](https://cloud.ibm.com/apidocs/tagging#attach-tag) and [Detach](https://cloud.ibm.com/apidocs/tagging#detach-tag) APIs
   - [Context-based restriction rule APIs](https://cloud.ibm.com/apidocs/context-based-restrictions#create-rule)
   - [Secrets Manager APIs](https://cloud.ibm.com/apidocs/secrets-manager/secrets-manager-v2)

## Next steps
{: #cbr-next-steps}

You must follow the creation or modification of zones or rules with adequate testing to ensure access and availability.

Users who attempt to access your resources outside of the defined zones receive `HTTP error 401` when the appropriate rules are not established.
{: note}