---
name: track-spend-with-cloudability-plan
title: Setting up IBM Cloudability Enablement Deployable Architecture
description: Running the IBM Cloudability Enablement deployable architecture requires authorization inputs from the IBM Cloud account. An IBM Cloudability API key is also needed to add your IBM Cloud account to IBM Cloudability. Follow these instructions to help create and manage your API keys.
last-updated: 2026-01-06
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/track-spend-with-cloudability?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Setting up IBM Cloudability Enablement Deployable Architecture
{: #planning}

Running the IBM Cloudability Enablement deployable architecture requires authorization inputs from the IBM Cloud account. An IBM Cloudability API key is also needed to add your IBM Cloud account to IBM Cloudability. Follow these instructions to help create and manage your [API keys](#x8051010){: term}.
{: shortdesc}

Authentication to IBM Cloudability is not required to run the deployable architecture. You can configure the deployable architecture to create the infrastructure and manually add the IBM Cloud account to Cloudability through its UI or re-configure the deployable architecture to add the IBM Cloud account to Cloudability later. See the [Cloudability configuration reference](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-configure&format=markdown) for more details.
{: notice}

## Cloudability authorization
{: #api-key}

The Cloudability Enablement deployable architecture supports two types of authentication to Cloudability:

1. [Cloudability API key](#acquiring-api-key) (simpler)
2. [Access Administration API key](#frontdoor-api-key) (more secure)

You must use the Access Administration API key approach to authenticate with Cloudability if you are using a GovCloud Cloudability environment.
{: notice}

### Before you begin
{: #cloudability-api-key-before-you-begin}

Ensure that your Cloudability user has an **Administrator** role so that it has sufficient permissions to add vendor accounts to Cloudability. If you don't have access to a Cloudability account, then visit the guide on [accessing your Cloudability account](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-accessing-cloudability&format=markdown).

Create your API Key as a functional user (for example: **cloudability-integration**) with access to add cloud vendors.
{: recommend}

Securely store your API Key in [IBM Cloud Secrets Manager](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started&format=markdown) as an arbitrary key. Secrets Manager makes it easier to rotate the API key and allows it to be referenced in [IBM® Projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-project-faqs&format=markdown#project-log-issue) without exposing the key in your deployable architecture configurations.
{: recommend}

### Option 1: Acquiring a Cloudability api key
{: #acquiring-api-key}

The Cloudability API key is the easiest way to authenticate with Cloudability. However, it is considered less secure than using the Frontdoor open token authentication.
A logged in user can retrieve a Cloudability API key from the [Cloudability account preferences](https://app.apptio.com/cloudability#/settings/preferences). Use the following steps to create your API key:

1. Log in to your [Cloudability account](https://frontdoor.apptio.com/login/).
2. Click the profile icon in the upper right corner to navigate to the **Settings** page.
3. Select **Manage Profile**.
4. Select the **Preferences** tab to reveal the **Cloudability API** section on the right.
5. If an API Key is not viewable, click **Enable Access** to reveal the API Key displayed in the text box.
6. Copy and securely store the API Key for the next step of [configuring the deployable architecture](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-deploy-cloud&format=markdown).

See the [Cloudability getting started API documentation](https://www.ibm.com/docs/en/cloudability-commercial){: external} for more details.

### Option 2: Acquiring an Access Administration API key
{: #frontdoor-api-key}

The Access Administration API key is the more secure approach to authenticate with Cloudability. It also allows creating multiple api keys, which can be used to rotate API Keys. However, using Access Administration authentication requires additional inputs to configure the deployable architecture.

A logged in user can create an Access Administration API key from the [frontdoor user profile](https://frontdoor-ui.apptio.com/profile?tab=apiKeys). Use the following steps to create your API key:

1. In the [**User Profile** page](https://frontdoor-ui.apptio.com/profile), select the **API Keys** tab.
2. Select **Create API Key**, which displays a dialog.
3. Type a **Key Name** and **Description**.
4. Select an expiration policy, and select **Confirm**.
5. Note the public key. Select the ![copy icon](./images/copy.svg) to copy the secret key. You can only access the secret key while creating the API key. Store the public key and secret key as an arbitrary key in Secrets Manager to be accessed later.
6. Click **Grant Access** on the newly created API Key in the table of API Keys
7. Select the desired environment from the list of environments and then click **Next**
8. Select roles for the API key. Select **Next**, and then select **Confirm**.
9. In the [**User Profile** page](https://frontdoor-ui.apptio.com/profile), select the **Environment Access** tab.
10. Note the Environment Id below the environment name in the table of Environments and the corresponding API Keys. Save the Environment Id when [configuring the deployable architecture](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-deploy-cloud&format=markdown).

See the [Cloudability access administration documentation](https://www.ibm.com/docs/en/cloudability-commercial/cloudability-enterprise/saas?topic=gscav-enhanced-access-administration-api-authentication-via-api-keys){: external} for more details and FAQ on Access Administration API keys.


## Configuring IBM Cloud IAM permissions
{: #cloudability-iam-prereqs}

Authorization needs to be granted to either a trusted profile, user, or service ID, which is referred to as an operator. This operator is [associated with the Project](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-authorize-project&format=markdown) so that it has the permissions to run the Cloudability deployable architecture.

For enterprise accounts the IAM credentials only need to be configured in the primary Enterprise account to allow IBM Cloudability to access billing reports for all current and future accounts within the IBM Cloud Enterprise. It is unnecessary to independently add each account within the enterprise.
{: important}

### Before you begin
{: #iam-before-you-begin}

If you have the following access, you can create access credentials to run the deployable architecture:

- Account owner
- Administrator role on all account management services
- Administrator role on the IAM Identity Service. For more information, see [IAM Identity service](https://cloud.ibm.com/docs/account?topic=account-account-services&format=markdown#identity-service-account-management)


### Required policies
{: #required-policies}

Add the access policies to an [access group](https://cloud.ibm.com/docs/account?topic=account-groups&format=markdown) rather than directly adding the policies to your deployable architecture operator (trusted profile, user, or service ID.).
{: recommend}

The following access policies are necessary to run the deployable architecture.

| Service | Platform Roles | Service Roles | Reason |
|------|-------------|------|---------|
| `IBM Cloud Object Storage` | `Administrator` | `Writer`, `ObjectReader` | The `Writer` role is needed to create/delete and configure a bucket in a Object Storage instance. \nThe `Administrator` role is needed to: \n 1. Create the iam policy, which grants IBM Cloud access to read the billing reports in the bucket. \n 2. create the service authorization between Billing and IBM Cloud Object Storage 3. create the context-based restrictions for the Object Storagebucket.\n `ObjectReader` is needed to read the list of objects in the bucket in order to validate that billing reports are added to the bucket. |
| `Key Protect` | `Administrator` | `Manager` | Used to create a key, key ring in a Key Protect instance for bucket encryption and create a context-based restriction between the Key Protect instance and the COS bucket. |
| `Schematics` | `Administrator` | N/A | Allows for the creation of a Schematics context-based restriction zone so Projects is able to update and destroy the COS bucket after provisioning. |
| `Context-based Restrictions` | `Editor` | N/A | Allows access to add network zones to your context based restriction rules. |
| `Billing` | `Administrator` | N/A | Used to configure account billing exports to the IBM Cloud Object Storage bucket |
| `IAM Access Management` | `Administrator` | N/A | 1. Create custom iam roles for least privileged access for IBM Cloudability.\n 2. Create service authorizations between Object Storage and Key Protect and between Billing and IBM Cloud Object Storage.\n 3. Ability to grant policies to the Cloudability service ID to read the billing reports from the bucket. |
| `Enterprise` | `Administrator` | N/A | Only for enterprise accounts. Used to manage the iam policy for IBM Cloudability to view the list of child accounts. |
| `All Account Management` | `Administrator` | N/A | Only if the deployable architecture is creating a new Resource Group to provision resources. `Administrator` is needed (as opposed to the `Editor` role) to delete the resource group in the event of deprovisioning. Alternatively resources can be placed in an existing resource group in which case access needs to be granted to that resource group. See [giving access to resources in resource groups](https://cloud.ibm.com/docs/account?topic=account-rgs_manage_access&interface=ui&format=markdown) for more details. |
{: caption="Access Policies" caption-side="bottom"}

### Using an access groups
{: #access-groups}

1. [Create an access group](https://cloud.ibm.com/docs/account?topic=account-groups&interface=ui&format=markdown#create_ag)
2. Assign the access policies from [Table 1](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-planning&format=markdown#iam-before-you-begin) to the access group.
3. Add the Operator (user, service ID, trusted profile) as a [member of the access group](https://cloud.ibm.com/docs/account?topic=account-groups&interface=ui&format=markdown#add-users-ag).
4. Create an API Key if the Operator is a [user](https://cloud.ibm.com/docs/account?topic=account-userapikey&interface=ui&format=markdown) or [service ID](https://cloud.ibm.com/docs/account?topic=account-serviceidapikeys&interface=ui&format=markdown). Alternatively use [IBM Secrets Manager to manage the IAM credentials](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-iam-credentials&interface=ui&format=markdown) of your service ID.

It is recommended to store any user or service [API keys in Secrets Manager](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-authorize-project&interface=ui&format=markdown). Secrets manager allows you to easily rotate credentials and prevents exposing highly privileged credentials to any users who are responsible for the running and management of the project that is used to run the deployable architecture.
{: recommend}


### Using a trusted profile
{: #trusted-profile}

1. [Create a Project](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-setup-project&format=markdown)
2. [Create a Trusted Profile for the Project](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-project&format=markdown#create-projects-tp)
3. Assign the access policies from [Table 1](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-planning&format=markdown#iam-before-you-begin) and the [trusted profile policies that are needed by Projects](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-project&format=markdown#create-projects-tp) to the trusted profile.
4. Copy the [the trusted profile ID](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-tp-project&format=markdown#find-tp-id) for the next step to [deploy the deployable architecture](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-deploy-cloud&format=markdown)

## Next steps
{: #planning-next-steps}

You are now ready to [run the deployable architecture](https://cloud.ibm.com/docs/track-spend-with-cloudability?topic=track-spend-with-cloudability-deploy-cloud&format=markdown) by using IBM Cloud Projects.