Monitoring enterprise IAM templates

Analyzing template create events in the enterprise account

Complete the following steps to review the creation of IAM templates in an enterprise account:

1. In the IBM Cloud console, go to the Navigation Menu icon > Observability > Activity Tracker.
2. Click Open dashboard on the dashboard that you use to monitor enterprise IAM templates.
3. Click Sources and select the IAM service name to filter the results and view only events for the type of template that you're looking for.
   • Access group templates: iam-groups
   • Trusted profile templates: iam-identity
   • Settings templates: iam-identity
   • Policy templates: iam-access-management
4. Search for the template.create action.
   1. For access group templates, search for action:iam-groups.group-template.create
   2. For trusted profile templates, search for action:iam-identity.profile-template.create
   3. For settingstemplates, search for action:iam-identity.account-settings-template.create
   4. For access group templates, search for action:iam-access-management.policy-template.create

Use the search field to view new version events by adding responseData.version=={{version number}} to your search. For example, action:iam-identity.profile-template.create responseData.version=={{version number}}.

Analyzing assignment events in the enterprise account

Complete the following steps to review IAM template assignments from the enterprise account to child accounts:

1. In the IBM Cloud console, go to the Navigation Menu icon > Observability > Activity Tracker.
2. Click Open dashboard on the dashboard that you use to monitor enterprise IAM templates.
3. Click Sources and select the IAM service name to filter the results and view only events for the type of template that you're looking for.
   • Access group templates: iam-groups
   • Trusted profile templates: iam-identity
   • Settings templates: iam-identity
   • Policy templates: iam-access-management
4. Use the search field to view IAM templates events.
   1. For access group templates, search for action:iam-groups.groups-assignment.create
   2. For trusted profile templates, search for action:iam-identity.profile-assignment.create
   3. For settings templates, search for action:iam-identity.account-settings-assignment.create
   4. For access policy templates, search for action:iam-access-management.policy-assignment.create
5. Select an event to view the fields that have identifying information.

To search for failed assignments, add outcome==failure to your search. For example, action:iam-groups.groups-assignment.create outcome==failure.

Analyzing events in child accounts

All enterprise-managed IAM resources that are created in child accounts from an enterprise assignment contain request data that maps the resource to an enterprise IAM template.

The request data includes the following attributes and example values:

"template_version": "1",
"template_id": "706f6c69637954656d706c6174652" ,
"assignment_id": "76450570-1ef3-41d2-ab24-935966032f93"

Complete the following steps to review IAM template assignments in your child account:

1. In the IBM Cloud console, go to the Navigation Menu icon > Observability > Activity Tracker.
2. Click Open dashboard on the dashboard that you use to monitor IAM events.
3. Click Sources and select the IAM service name to filter the results and view only events for the type of template that you're looking for.
   • Access group templates: iam-groups
   • Trusted profile templates: iam-identity
   • Settings templates: iam-identity
   • Policy templates: iam-access-management
4. Use the search field to view enterprise-managed IAM events by searching for template.

Policy template creation

An access policy template that is named SecretsEditor is created and has the following identifying attributes:

"policy": "{  \"type\": \"access\",  \"control\": {    \"grant\": {      \"roles\": [        {          \"role_id\": \"crn:v1:bluemix:public:iam::::role:Editor\"        }      ]    }  },  \"resource\": {    \"attributes\": [      {        \"value\": \"hyperp-dbaas-mongodb\",        \"operator\": \"stringEquals\",        \"key\": \"serviceName\"      }    ]  }}"

Access group template creation

An access group template that is named dev-group-1 hasn't been committed yet:

    "group": {
      "action_controls": "{  "access": {    "add": true  }}",
      "assertions": "{  "action_controls": {    "add": true,    "remove": false,    "update": false  },  "rules": [    {      "action_controls": {        "remove": false,        "update": false      },      "conditions": [        {          "claim": "blueGroup",          "operator": "CONTAINS",          "value": "\\"test-bluegroup-saml\\""        }      ],      "expiration": 12,      "name": "Manager group rule",      "realm_name": "https://idp.example.org/SAML2"    }  ]}",
      "description": "Access group description",
      "members": "{  "action_controls": {    "add": true,    "remove": false  },  "services": [    "ServiceId-ad7d5c39-da76-4145-aa55-ffb87aa81715",    "ServiceId-d9ddc9ca-9c4c-4405-839f-43a25fdefd0e"  ],  "users": [    "IBMid-50PJGPKYJJ",    "IBMid-665000T8WY"  ]}",
      "name": "groupName 1690274020835 - VPC-Staging"
    }

"policy_template_references": [
      {
        "id": "policyTemplate-2c8998aa-a706-4e07-bc35-6f23c9753c51",
        "version": "1"
      },
      {
        "id": "policyTemplate-998f1122-aca4-4094-a6dd-b14010d487bf",
        "version": "1"
      }
    ]

Access group template assignment

An access group template named dev-group-1 that's assigned to child accouts has the following identifying attributes:

Trusted profile template creation

Trusted profile template assignment

curl -H "Authorization: Bearer $TOKEN" "https://iam.test.cloud.ibm.com/v1/profile_assignments/TemplateAssignment-691487d2-a249-4475-b976-a7bf655ef3be"