RBAC, groups and IAM integration

Add permissions through the CLI

To create an access group policy by using the CLI, you can use the ibmcloud iam access-group-policy-create command with the viewer role.

ibmcloud iam access-group-policy-create GROUP_NAME {-f, --file @JSON_FILE | --roles ROLE_NAME1,ROLE_NAME2... [--service-name SERVICE_NAME] [--service-instance SERVICE_INSTANCE] [--region REGION] [--resource-type RESOURCE_TYPE] [--resource RESOURCE] [--resource-group-name RESOURCE_GROUP_NAME] [--resource-group-id RESOURCE_GROUP_ID]}

For example, you can run the following command to grant a user viewer permissions:

ibmcloud iam access-group-policy-create my-access-group --roles Viewer --service-name my-auditing-instance --service-instance 99999999-9999-9999-999999

Add permissions through the UI

Complete the following steps to assign a policy to an access group through the UI:

1. From the menu bar, click Manage > Access (IAM), and select Access Groups.

2. Select the name of the group that you want to assign access to.

3. Click Access policies > Assign access > Assign access to resources.

4. Select IAM services.

5. In the section What type of access do you want to assign?, select IBM Log Analysis.

6. In the section Which services do you want to assign access to?, choose one of the following options:

   Select All services to define the scope of the policy to include all instances.

   Select Services based on attributes to refine the scope of the policy. Choose 1 of the following options:

   Option 1: The scope is set to a resource group. Select Resource group to choose 1 resource group and define the scope of the policy to include all instances that are associated with that resource group.

   Option 2: The scope is set to 1 instance in a resource group. Select Resource group to choose the resource group. Then select Service Instance to choose the instance within the resource group.

   Option 3: The scope is set to 1 instance. Select Service Instance to choose the instance.

   Do not specify a value in the logGroup section.

7. Select the viewer platform role.

8. Click Add.

9. Click Assign.

Add permissions through the CLI

To create an access group policy by using the CLI, you can use the ibmcloud iam access-group-policy-create command.

ibmcloud iam access-group-policy-create GROUP_NAME {-f, --file @JSON_FILE | --roles ROLE_NAME1,ROLE_NAME2... [--service-name SERVICE_NAME] [--service-instance SERVICE_INSTANCE] [--region REGION] [--resource-type RESOURCE_TYPE] [--resource RESOURCE] [--resource-group-name RESOURCE_GROUP_NAME] [--resource-group-id RESOURCE_GROUP_ID]}

Where valid roles are Reader, Standard-member and manager.

You must use a JSON file to create the group policy.

For example, you can run the following command:

ibmcloud iam access-group-policy-create accessGroupName accessGroupGUID --file policy.json

Where

• accessGroupName is the access group name.
• accessGroupGUID is the GUID of the access group.

You can run the command ibmcloud iam access-groups to get the list of names and corresponding GUIDs in the account.

And use the following JSON file.

{
    "type": "access",
    "subjects": [
        {
            "attributes": [
                {
                    "name": "access_group_id",
                    "value": "AccessGroupGuid"
                }
            ]
        }
    ],
    "roles" : [
    {
            "role_id" : "crn:v1:bluemix:public:iam::::serviceRole:Reader"
    }
    ],
    "resources": [
        {
            "attributes": [
                {
                    "name": "accountId",
                    "value": "accountGuid"
                },
                {
                    "name": "serviceName",
                    "value": "logdnaat"
                },
                {
                    "name": "serviceInstance",
                    "value": "instanceGuid"
                },
                {
                    "name": "logGroup",
                    "value": "group1"
                }
            ]
        }
    ]
}

Add permissions through the UI

Complete the following steps to assign a policy to an access group through the UI:

1. From the menu bar, click Manage > Access (IAM), and select Access Groups.

2. Select the name of the group that you want to assign access to.

3. Click Access policies > Assign access > Assign access to resources.

4. Select IAM services.

5. In the section What type of access do you want to assign?, select IBM Log Analysis.

6. In the section Which services do you want to assign access to?, complete the following steps:

   1. Select Services based on attributes to refine the scope of the policy. Choose 1 of the following options:

      Option 1: Set the scope to 1 instance in a resource group. Select Resource group to choose the resource group. Then select Service Instance to choose the instance within the resource group.

      Option 2: Set the scope to 1 instance. Select Service Instance to choose the instance.

   2. Select a logGroup.

7. Select a service role. The service role defines the permissions a user has to view and manage resources in that group.

   • Select manager to grant admin permissions for the service.

   • Select reader to grant permissions to view data only.

   Learn more about the roles that you need.

8. Click Add.

9. Click Assign.

Add a user to the access group

Complete the following steps to add a user:

1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click Add users on the Users tab.
4. Select the users that you want to add from the list, and click Add to group.

Add a service ID to the access group

Complete the following steps to add a service ID:

1. From the menu bar, click Manage > Access (IAM), and select Access Groups.
2. Select the name of the group that you want to assign access to.
3. Click the Service IDs tab, and click Add service ID.
4. Select the IDs that you want to add from the list, and click Add to group.