ibmcloud-iam
manages IBM Cloud Identity and Access Management
TLDR
SYNOPSIS
ibmcloud iam command [arguments] [options]
DESCRIPTION
ibmcloud iam manages Identity and Access Management for the targeted IBM Cloud account. It creates and revokes API keys, defines service IDs and trusted profiles for non-human identities, groups users into access groups, and attaches the policies that grant roles on resources.The command group is built into the core CLI, so no plugin is needed. All operations apply to the account currently targeted by ibmcloud target, and most listing commands accept --output json for scripting.Access in IBM Cloud is granted by policies that bind a subject (user, service ID, trusted profile, or access group) to a target (an account, resource group, service instance, or resource type) with one or more roles. Assigning policies to an access group instead of individual users is the recommended way to keep permissions manageable.
PARAMETERS
api-keys [--uuid] [-n STRING] [-d STRING]
List platform API keys, optionally filtered by name or description.api-key-create NAME [-d DESCRIPTION] [--file FILE] [--lock]
Create a platform API key. The secret is shown once; --file saves it as JSON.api-key-delete, api-key-update, api-key-lock, api-key-unlock
Manage an existing API key.service-ids [--uuid] [-n STRING] [-d STRING]
List service IDs in the current account.service-id-create NAME [-d DESCRIPTION] [--lock]
Create a service ID for machine-to-machine access.service-api-key-create NAME SERVICEID_
Create an API key bound to a service ID.access-groups [-u USER | -s SERVICEID | **-p** PROFILE_]
List access groups, optionally only those a user, service ID, or trusted profile belongs to.access-group-create GROUPNAME [**-d** DESCRIPTION_]
Create an access group.access-group-user-add, access-group-user-remove, access-group-service-id-add
Manage access group membership.access-group-policy-create GROUPNAME_
Attach an access policy to an access group.user-policies USERNAME_
List all access policies of a user.user-policy-create, user-policy-update, user-policy-delete
Manage a user's access policies.service-policies, service-policy-create
List or create policies attached to a service ID.authorization-policies, authorization-policy-create
Manage service-to-service authorizations.trusted-profiles, trusted-profile-create, trusted-profile-link-create
Manage trusted profiles and the compute resources linked to them.roles [--service SERVICENAME_]
List platform, service-defined, and custom roles.oauth-tokens
Retrieve and display the OAuth tokens of the current session.bearer-token
Print the bare Bearer token of the current session.account-settings, account-settings-update
View or change account-wide IAM settings such as session lifetime and MFA.
CAVEATS
An API key secret is displayed only when it is created. Save it with --file or copy it immediately; it cannot be retrieved later, only deleted and recreated.Managing other identities requires administrator rights on the IAM Identity Service or on the account. Policy changes take effect within seconds but cached tokens keep their old authorizations until they are refreshed.Deleting a service ID revokes every API key bound to it, which breaks any automation still using those keys.
HISTORY
ibmcloud iam is part of the IBM Cloud CLI, which replaced the earlier `bluemix` (`bx`) CLI when Bluemix was rebranded to IBM Cloud around 2018. Access groups, trusted profiles, and policy templates were added to the command group as the IAM service gained them.
SEE ALSO
ibmcloud(1), ibmcloud-login(1), ibmcloud-target(1), ibmcloud-ks(1)
