--- name: vpc-vsi_is_object_storage_auth title: Granting access to IBM Cloud Object Storage to import and export images description: To import a custom image to IBM Cloud VPC, or to export a custom image from IBM Cloud VPC, you must have an instance of IBM Cloud® Object Storage available. You must also create a bucket in Object Storage to store your images. Finally, you must create an authorization so that the Image Service for VPC can access Object Storage. last-updated: 2026-06-26 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Granting access to IBM Cloud Object Storage to import and export images {: #object-storage-prereq} To import a custom image to IBM Cloud VPC, or to export a custom image from IBM Cloud VPC, you must have an instance of IBM Cloud® Object Storage available. You must also create a bucket in Object Storage to store your images. Finally, you must create an authorization so that the Image Service for VPC can access Object Storage. {: shortdesc} ## Creating an IBM Cloud Object Storage service instance {: #migrate-prereq-icos-instance} If you need to create an instance of IBM Cloud Object Storage, see [Getting started with IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage&format=markdown). From Cloud Identity and Access Management, you must create an authorization so that the Image Service for VPC can access IBM Cloud Object Storage. ## Creating an authorization {: #migrate-prereq-create-service-authorization} To authorize the Image Service for VPC to access the target service, IBM Cloud Object Storage, you must create an [authorization](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&format=markdown). To import an image, you must specify the Reader service access role for Object Storage. To export an image, you must specify the Writer service access role for IBM Cloud Object Storage. With both Reader and Writer service access roles for Object Storage, you can both import and export images. ### Granting Reader and Writer access in the console {: #custom-image-service-authorization-rw-ui} {: ui} Complete the following steps to create an authorization for the Image Service for VPC to both import images from an IBM Cloud Object Storage service instance and export images to an IBM Cloud Object Storage service instance. 1. From the [IBM Cloud console](https://console.cloud.ibm.com){: external} menu bar, click **Manage > Access (IAM)**, and select **Authorizations**. 2. On the Manage authorizations page, click **Create**. 3. Make your selection for the **Source account**. By default **This account** is selected. Click **Next**. 4. Select a source service for the authorization. Specify **VPC Infrastructure Services** as the source service. Click **Next**. 5. For Resources, select how you want to scope the access. 1. Select **Specific resources**. 2. For Specific resources, select **Resource type** and **Image service for VPC**. 3. Click **Next**. 6. For the Target service, select **Cloud Object Storage**. Click **Next**. 7. For Resources, specify how you want to scope the access. You can use the default selection of **All resources**. Click **Next**. If you want to scope the access to a specific resource within IBM Cloud Object Storage, you can select **Resources based on selected attributes**. Then, make selections to narrow the access according to your preferences. {: tip} 9. For Roles, select both service access roles, **Reader** and **Writer**. 10. Click **Review** to make sure that your selections look correct. 11. Click **Authorize**. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/iam?topic=iam-serviceauth&format=markdown#serviceauth). ### Granting Reader and Writer access to all buckets from the CLI {: #custom-image-service-authorization-rw} {: cli} To grant both `Reader` and `Writer` access to all buckets in IBM Cloud Object Storage, run the `iam authorization-policy-create` command. The following command authorizes the Image Service for VPC to both import images from any bucket in an Object Storage service instance and export images to any bucket in an Object Storage service instance. ```sh ibmcloud iam authorization-policy-create is cloud-object-storage Reader,Writer --source-resource-type image ``` {: pre} For more information, see [`ibmcloud iam authorization-policy-create`](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam&format=markdown#ibmcloud_iam_authorization_policy_create). ### Granting access to a specific bucket from the CLI {: #custom-image-service-authorization-bucket} {: cli} You can choose to grant authorization to a specific bucket in IBM Cloud Object Storage. The following example describes how to grant `Reader` access to a specific bucket for importing images from Object Storage. To export an image to Object Storage, you must also grant `Writer` access. Before you run the command, you need to know the GUID for the Object Storage service instance. 1. Use the `ibmcloud resource service-instance` command to obtain the GUID. See the following example: ```sh $ ibmcloud resource service-instance cos-fs-cloud-us-south Retrieving service instance cos-fs-cloud-us-south in all resource groups under account Test Account as test.user@ibm.com... OK Name: cos-fs-cloud-us-south ID: crn:v1:bluemix:public:cloud-object-storage:global:a/a1234567:0e4a33e6-973e-42b6-bea4-ce1b3aebe163:: GUID: 0e4a33e6-973e-42b6-bea4-ce1b3aebe163 Location: global Service Name: cloud-object-storage Service Plan Name: standard Resource Group Name: defaults State: active Type: service_instance Sub Type: Locked: false Created at: 2021-07-27T14:40:45Z Created by: IBMid-12345678 Updated at: 2021-07-27T14:40:47Z Last Operation: Status create succeeded Message Completed create instance operation ``` {: screen} 1. Run the following command and replace `$COS_INSTANCE_GUID` with the `GUID` value. ```sh ibmcloud iam authorization-policy-create is cloud-object-storage Reader --source-resource-type image --target-service-instance-id $COS_INSTANCE_GUID ``` {: pre} A successful response looks like the following example: ```sh $ ibmcloud iam authorization-policy-create is cloud-object-storage Reader --source-resource-type image --target-service-instance-id 0e4a33e6-973e-42b6-bea4-ce1b3aebe163 Creating authorization policy under account a1234567 as test.user@ibm.com... OK Authorization policy 0bbcb168-bf7b-4ebf-9684-769f1d7e80e7 was created. ID: 0bbcb168-bf7b-4ebf-9684-769f1d7e80e7 Source service name: is Source service instance: All instances Source resource type: image Target service name: cloud-object-storage Target service instance: 0e4a33e6-973e-42b6-bea4-ce1b3aebe163 Roles: Reader ``` {: screen} For more information about all of the parameters that are available for this command, see [`ibmcloud iam authorization-policy-create`](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam&format=markdown#ibmcloud_iam_authorization_policy_create). ### Granting access with the API {: #auth-api} {: api} To authorize a source service access to a target service, use the [IAM Policy Management API](https://cloud.ibm.com/docs/apis/iam-policy-management#create-policy). See the following API example for Create a policy method with the `type=authorization` specified. All of the possible attributes are listed. The supported attributes for creating an authorization policy depend on what each service supports. For more information about the supported attributes for each service, refer to the documentation for the services that you're using. {: note} The example shows an authorization policy for the Image Service for VPC to access IBM Cloud Object Storage. ```sh curl --location --request POST 'https://iam.cloud.ibm.com/v1/policies' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer ' \ --data-raw '{ "type": "authorization", "subjects": [ { "attributes": [ { "name": "accountId", "value": "$ACCOUNT_ID" }, { "name": "serviceName", "value": "is" }, { "name": "resourceType", "value": "image" } ] } ], "roles": [ { "role_id": "crn:v1:bluemix:public:iam::::serviceRole:Reader" }, { "role_id": "crn:v1:bluemix:public:iam::::serviceRole:Writer" } ], "resources": [ { "attributes": [ { "name": "accountId", "value": "$ACCOUNT_ID" }, { "name": "serviceName", "value": "cloud-object-storage" } ] } ] }' ``` {: codeblock} ### Granting access with Terraform {: #custom-image-service-authorization-tf} {: terraform} To create a service-to-service authorization policy for IBM Cloud Object Storage, use the `ibm_iam_authorization_policy` resource argument in your `main.tf` file. ```terraform resource "ibm_iam_authorization_policy" "policy" { source_service_name = "is" source_resource_type = "image" target_service_name = "cloud-object-storage" roles = ["Reader","Writer"] description = "Authorization Policy" } ``` {: codeblock} For more information about the arguments and attributes, see the [Terraform documentation for authorization resources](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy){: external}. ## Next steps {: #next-grant-icos-auth} After you completed these steps so that Image Service for VPC can access images in Object Storage or export images to Object Storage, continue with one of the following topics: * [Creating a Linux-based custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-linux-custom-image&format=markdown) * [Creating a Windows-based custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-create-windows-custom-image&format=markdown) * [Importing a custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-importing-custom-images-vpc&format=markdown) * [Exporting a custom image](https://cloud.ibm.com/docs/vpc?topic=vpc-managing-custom-images&format=markdown#custom-image-export-to-cos)