IAM: Identity and Access Management

IBM Cloud Identity and Access Management (IAM) controls who can access your resources and what they can do. Properly configured IAM is the foundation of a secure IBM Cloud environment.

---

IBM Cloud Accounts

When you sign up for IBM Cloud, you create an account. The account owner has full control over:

• All resources in the account
• Billing and usage
• User invitations and access policies

Account Types

Type	Description
Lite	Free, no credit card required, access to Lite plan services
Pay-As-You-Go	Full catalogue access, pay only for what you use
Subscription	Commit to monthly spending for discounts

---

Users and Access Groups

Users

You can invite users to your IBM Cloud account by email. Each user gets:

• A unique IBMid
• Console access (web UI)
• CLI and API access via API keys

Access Groups

Access groups let you organise users and assign permissions collectively:

Access Group: Cloud-Developers
├── User: alice@example.com
├── User: bob@example.com
└── User: charlie@example.com
    → Policy: Editor role on all Kubernetes resources
    → Policy: Viewer role on Cloud Object Storage

Best practice: Always assign policies to access groups, not individual users.

---

IAM Roles

IBM Cloud IAM uses roles to define what actions a user can perform:

Platform Roles

Control access to platform-level actions (managing resources, viewing billing):

Role	Description
Viewer	View resources and their details
Operator	View resources and perform platform actions (e.g., restart)
Editor	Create, update, and delete resources
Administrator	Full access including managing access policies

Service Roles

Control access to service-specific actions (reading data, invoking APIs):

Role	Description
Reader	Read-only access to service data
Writer	Read and write access to service data
Manager	Full control over the service including configuration

Custom Roles

For fine-grained control, you can create custom roles that combine specific actions.

---

Access Policies

An access policy grants a role to a user or access group on a specific scope:

Policy:
  Subject: Access Group "Cloud-Developers"
  Role: Editor (Platform) + Writer (Service)
  Target: All resources in resource group "Production"

Policy Scopes