copyright | lastupdated | keywords | subcollection | ||
---|---|---|---|---|---|
|
2022-11-05 |
schematics, automation, terraform |
schematics |
{{site.data.keyword.attribute-definition-list}}
{: #access}
Use {{site.data.keyword.iamlong}} to grant permissions to {{site.data.keyword.bpshort}} Workspaces and actions. {: shortdesc}
As the {{site.data.keyword.cloud_notm}} account owner, you want to ensure that you control user access to workspaces and the actions in your account. {{site.data.keyword.bplong_notm}} integrate with {{site.data.keyword.iamlong}} (IAM) to securely authenticate users for platform services and control access to resources. IAM uses the concept of resource groups, access groups, roles, and access policies to manage the access to {{site.data.keyword.cloud}} resources. For more information about how IAM works and how you can use resource groups, access groups, and access policies to organize {{site.data.keyword.bpshort}} access for a team, see What is {{site.data.keyword.iamlong}}?
{: #access-roles} {: help} {: support}
Grant access to {{site.data.keyword.bplong_notm}} by assigning {{site.data.keyword.iamlong}} (IAM) service access roles to your users. {: shortdesc}
Who must grant access to {{site.data.keyword.bplong_notm}}?
As the account owner or an authorized account administrator, you can assign IAM service access roles to your users. The IAM service access roles determine the actions that you can perform on an {{site.data.keyword.bplong_notm}} resource, such as a workspace or an action. To avoid assigning access policies to individual users, consider creating IAM access groups.
Is access to {{site.data.keyword.bplong_notm}} sufficient to manage {{site.data.keyword.cloud_notm}} resources?
No. If you are assigned an {{site.data.keyword.bplong_notm}} service access role, you can view, create, update, or delete workspaces and actions in {{site.data.keyword.bplong_notm}}. However, to manage other {{site.data.keyword.cloud_notm}} resources with {{site.data.keyword.bpshort}}, you must be assigned the IAM platform or service access role for the individual {{site.data.keyword.cloud_notm}} resource that you want to work with. see the documentation for your resource to determine the access policies that you need to work with your resource.
{: #workspace-permissions}
Review the following table to see what permissions you need to work with {{site.data.keyword.bpshort}} Workspaces.
{: #action-permissions}
Review the following table to see what permissions you need to work with {{site.data.keyword.bpshort}} Actions.
{{site.data.keyword.bpshort}} Blueprints is a Beta feature that is available for evaluation and testing purposes. It is not intended for production usage. Refer to the list of limitations for the Beta release. {: beta}
{: #blueprint-permissions}
Review the following table to see what permissions you need to work with {{site.data.keyword.bpshort}} Blueprint.
In addition to the listed blueprints activities and permission, you must check whether you have related workspace permissions for blueprint config create
, blueprint run apply
, blueprint config delete
, and blueprint run destroy
activities to execute successfully.
{: important}
{: #kms-permissions}
Review the following table to see what permissions you need to work with {{site.data.keyword.bpshort}} key management system.
{: #access-setup}
As the {{site.data.keyword.cloud_notm}} account owner or authorized account administrator. Create an IAM access group for your users and assign service access policies to {{site.data.keyword.bplong_notm}} and the resources that you want your users to work with.
{: shortdesc}
-
Invite users to your {{site.data.keyword.cloud_notm}} account.
-
Define your teams and create an IAM access group for each team.
-
Create a resource group for each teams. So that you can organize access to their {{site.data.keyword.cloud_notm}} services and workspaces in your account, and bundle them under one common view and billing process. If you want to keep your {{site.data.keyword.bpshort}} Workspaces and actions separate from the {{site.data.keyword.cloud_notm}} resources, you must create multiple resource groups.
-
Assign access to your IAM access group. Consider the following guidelines when you assign access to an IAM access group:
- Make sure to scope access of your group to the resource group that you created for this team.
- If you want your team to have access to multiple resource groups, such as the Administrator and Manager permissions on all resources in resource group A, but Viewer access for the resources in resource group B, you must create multiple access policies.
- The resource group of the {{site.data.keyword.bpshort}} Workspaces or action can be different from the resource group of the {{site.data.keyword.cloud_notm}} resources that you want to work with.
- For a team to use {{site.data.keyword.bpshort}}, you must assign the appropriate service access role for {{site.data.keyword.bpshort}}, and the permissions that are required for the {{site.data.keyword.cloud_notm}} resources that this team manages with {{site.data.keyword.bpshort}}. You can review the documentation for each of the {{site.data.keyword.cloud_notm}} services to find the appropriate IAM access policy.
{: #access-tag}
You can now centrally manage access tags to the {{site.data.keyword.bpshort}} Workspaces in your account at scale. Tags contains the metadata values in the form of key and value to help you organize your cloud data. Tags are essential, as it helps to efficiently optimize your workspace within your account. Following steps helps to create and associate access tags for {{site.data.keyword.bpshort}} Workspaces in your account.
- To create an access tag, see Create an access management tag.
- To associate access tags, see Attach your access management tag to a {{site.data.keyword.bpshort}} Workspaces
For more information about managing access tags, see Controlling access to resources by using tags.