vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For example, you can run the following curl command to use an API key that is named MY_APIKEY to get an IAM token:

curl -X POST 'https://iam.cloud.ibm.com/identity/token' -H 'Content-Type: application/x-www-form-urlencoded' -d
'grant_type=urn:ibm:params:oauth:grant-type:apikey&apikey=MY_APIKEY'

For more information, see [Creating an IAM access token for a user or service ID by using an API key](https://cloud.ibm.com/apidocs/iam-identity-token-apigettoken-apikey).
* [Creating an access group](https://cloud.ibm.com/docs/account?topic=account-groupscreate_ag).
* [Assigning access to a group](https://cloud.ibm.com/docs/account?topic=account-groupsaccess_ag).







 Managing access by assigning policies directly to users 

To manage access or assign new access for users by using IAM policies, you must be the account owner, administrator on all services in the account, or an administrator for the particular service or service instance.

Choose any of the following actions to manage IAM policies in the IBM Cloud:



* To grant permissions to a user, see [Assigning access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesassign_new_access).
* To revoke permissions, see [Removing access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesremoving_access).
* To review a user's permissions, see [Reviewing your assigned access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesreview_your_access).







 Managing access through trusted profiles 

[Trusted profiles](https://cloud.ibm.com/docs/account?topic=account-identity-overviewtrustedprofiles-bestpract) are supported.





 IBM Cloud platform roles 

The following tables detail actions that are mapped to platform roles.

Platform roles enable users to perform tasks on service resources at the platform level, for example, assign user access for the service, create or delete instances, and bind instances to applications.

Use the following table to identify the platform role for the Activity Tracker hosted event search offerings that you can grant a user in the IBM Cloud to run any of the following platform actions:



Table 12. IAM user platform roles and actions for Activity Tracker hosted event search offerings

 Platform actions Administrator Editor Operator Viewer 

 Grant other account members access to work with the service !
Table 21. Roles and example actions for the User Management service

 Roles Actions role_ID value 

 Viewer View users in the account<br><br>View user profile settings crn:v1:bluemix:public:iam::::role:Viewer 
 Operator View users in the account<br><br>View user profile settings crn:v1:bluemix:public:iam::::role:Operator 
 Editor View, invite, remove, and update users from the account<br><br>View and update user profile settings crn:v1:bluemix:public:iam::::role:Editor 
 Administrator View, invite, remove, and update users from the account<br><br>View and update user profile settings crn:v1:bluemix:public:iam::::role:Administrator 



The viewer role on the user management service is a role that is commonly assigned for users assigned a role to view or manage support cases. If an account owner restricts the visibility of the user list in the IAM settings, users can't see support cases that are opened by other users in the account. However, if they are assigned the viewer role for the user management service, the user list visibility setting doesn't affect the ability to view cases in the account.





 Activity Tracker Event Routing 

You can give users access to run platform actions.



Table 22. Roles and example actions for the Activity Tracker Event Routing service

 Roles Actions role_ID value 

 Viewer View Activity Tracker Event Routing configuration resources such as routes and targets. crn:v1:bluemix:public:iam::::role:Viewer 
 Operator View Activity Tracker Event Routing configuration resources such as routes and targets. crn:v1:bluemix:public:iam::::role:Operator 
 Editor View, create, update, and delete Activity Tracker Event Routing resources. crn:v1:bluemix:public:iam::::role:Editor 
 Administrator View, create, update, and delete Activity Tracker Event Routing resources.<br><br>Assign access policies to manage Activity Tracker Event Routing resources to other users in the account.
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 Revoke member access to configure Activity Tracker Event Routing iam-am.policy.delete ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 
 Modify member access to configure Activity Tracker Event Routing iam-am.policy.update ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 





Table 3. IAM platform roles for Activity Tracker Event Routing target actions

 Action IAM and Activity Tracker action Administrator Editor Operator Viewer 

 View a target atracker.target.read ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) !
<br> * [ibm_iam_service-api-key](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_service_api_key)<br> * [ibm_iam_service_id](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_service_id)<br> * [ibm_iam_service_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_service_policy)<br> * [ibm_iam_trusted_profile](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_trusted_profile)<br> * [ibm_iam_trusted_profile_claim_rule](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_trusted_profile_claim_rule)<br> * [ibm_iam_trusted_profile_link](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_trusted_profile_link)<br> * [ibm_iam_trusted_profile_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_trusted_profile_policy)<br> * [ibm_iam_user_invite](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_user_invite)<br> * [ibm_iam_user_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_user_policy)<br> * [ibm_iam_user_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_user_settings)<br><
* [Checking RBAC roles](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-rbac)
* [Checking infrastructure roles](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-infra)
* [Checking other cloud infrastructure provider roles](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-infra-providers)



* [Removing user permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-usersremoving)



* [Checking if the user's credentials are used for infrastructure permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-usersremoving_check_infra)
* [Removing a user from your account](https://cloud.ibm.com/docs/openshift?topic=openshift-usersremove_user)
* [Removing specific permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-usersremove_permissions)





[Authorizing pods in your cluster to IBM Cloud services with IAM trusted profiles](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identitypod-iam-identity)



* [Prerequisites](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-prereqs)
* [Creating an IAM trusted profile for your cluster in the API](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-create-api)
* [Creating an IAM trusted profile for your cluster in the UI](https://cloud.ibm.com/docs/openshift?topic=openshift-pod-iam-identityiam-identity-create-ui)
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 





Table 2. Service roles

 Service actions Manager Writer Reader 

 Run an SQL query ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/f61dbc5d84bf0c89e477a05cab04c72f429e1b7a/log-analysis/images/checkmark-icon.svg) 



Notice that users with the service role reader get an access error when they launch the SQL Query UI.

To manage access or assign new access for users by using IAM policies, you must be the account owner, administrator on all services in the account, or an administrator for the particular service or service instance.

Choose any of the following actions to manage IAM policies in the IBM Cloud:
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 





Table 2. Service roles

 Service actions Manager Writer Reader 

 Run an SQL query ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/6f3c07c34058f637b1c86044ca4f9b24214330a7/activity-tracker/images/checkmark-icon.svg) 



Notice that users with the service role reader get an access error when they launch the SQL Query UI.

To manage access or assign new access for users by using IAM policies, you must be the account owner, administrator on all services in the account, or an administrator for the particular service or service instance.

Choose any of the following actions to manage IAM policies in the IBM Cloud:



* To grant permissions to a user, see [Assigning access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesassign-new-access).
* To revoke permissions, see [Removing access](https://cloud.ibm.com/docs/account?topic=account-assign-access-resourcesremoving-access-console)).
Managing users 

Create provider organizations to manage API Connect, and map them to IBM Cloud IAM access groups to specify user permissions to the Catalogs and Spaces contained in each provider organization.

In API Connect Reserved, users are grouped into provider organizations. Each provider organization owns a set of assets including APIs, products, catalogs, spaces, and developer portals, and the users who are members of that provider organization can be assigned to roles that determine their level of access to the those assets. User access is managed with the IBM Cloud Identity and Access Management (IAM) service. When a user logs in to a Reserved instance, their permissions are determined by the IAM settings and overwrite any role definitions set in the API Connect UI.

Custom roles are not supported by the IAM service, so if you create custom roles in API Connect, they are deleted the next time each user logs in and their permissions sync with the IAM service.

You must assign a predefined role to each user to ensure they can access your resources. In API Connect, resources are managed in the following hierarchy:

![Resource hierarchy](https://cloud.ibm.com/docs-content/v1/content/78bb71851d95d7580503eb9ba10cf3ae31490ade/apiconnect/images/ri-resource-hierarchy.png)

To grant users permissions to the API Connect resources owned by a particular provider organization, add the users to that provider organization. The role that a user is assigned to for the provider organization is inherited by the catalogs within it, and by the spaces within each catalog. You can override this access at the lower levels by assigning the user to a different role. For example, if you only want the user to have Edit access in a particular space, assign the user to the Reader role for the provider organization, and then assign the user to a role with Edit access on the selected space. The user will still have only Reader access to the catalog owning the space, to all other spaces within the same catalog, and to alwildcard l other catalogs and spaces owned by the provider organization.
For more information, see [Service access roles](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-service-access). Possible values are Manager, Writer, or Reader.<br><br><br> 



3. Verify that the user or access group has the assigned role.



* For individual users

ibmcloud iam user-policies <user@email.com>
* For access groups

ibmcloud iam access-group-policies <access_group>









 Checking user permissions 

Before you complete a task, you might want to check that you have the appropriate permissions in IBM Cloud® Identity and Access Management (IAM).



 Checking IAM platform and service access roles from the UI 



1. Log in to the [IBM Cloud IAM console](https://cloud.ibm.com/iam).
2. From the navigation menu, click the Users tab.
3. In the table, click the user with the tag self for yourself or the user that you want to check.
4. Click the Access policies tab.
5. Review the Resource attributes column for a short description of the access. Click the number tag to view all the allowed actions for the role.
6. To review what the roles and allowed actions permit, see [Platform access roles](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-platform-access) and [Service access roles](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-service-access).
7. To change or assign new access policies, see [Assigning Satellite access](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-accessiam-assign-overview).







 Checking IAM platform and service access roles from the CLI 



1. Log in to your IBM Cloud account. If you have a federated ID, include the --sso option.

ibmcloud login -r [--sso]
2.
To review what the roles and allowed actions permit, see the following topics.



* [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions)
* [IBM Cloud Kubernetes Service user access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_reference)



7. To change or assign new access policies, see [Assigning IBM Cloud Kubernetes Service roles](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users).







 Checking IAM platform and service access roles from the CLI 



1. Log in to your IBM Cloud account. If you have a federated ID, include the --sso option.

ibmcloud login -r [--sso]
2. Find the User ID of the user whose permissions you want to check.

ibmcloud account users
3. Check the IAM access policies of the user.

ibmcloud iam user-policies <user_id>

Service access roles are synchronized with Kubernetes RBAC roles within your cluster. If you have a service access role, you might want to [verify your RBAC role](https://cloud.ibm.com/docs/containers?topic=containers-userschecking-rbac), too.
4. To review what the roles and allowed actions permit, see the following topics.



* [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions)
* [IBM Cloud Kubernetes Service user access permissions](https://cloud.ibm.com/docs/containers?topic=containers-access_reference)



5. To change or assign new access policies, see [Assigning IBM Cloud Kubernetes Service roles](https://cloud.ibm.com/docs/containers?topic=containers-usersadd_users_cli).









 Checking RBAC roles
To simplify access, Hyper Protect Crypto Services aligns with [IAM roles](https://cloud.ibm.com/docs/account?topic=account-userroles) so that each user has a different view of the service, according to the role the user is assigned. If you are a service administrator, you can assign Cloud IAM roles that correspond to the specific Hyper Protect Crypto Services permissions you want to grant to members of your team.

The following table lists the IBM Cloud IAM roles in the context of Hyper Protect Crypto Services. For complete IAM documentation and how to assign access, see [Managing access in IBM Cloud](https://cloud.ibm.com/docs/account?topic=account-cloudaccess).

Use IBM Cloud platform access roles to grant permissions at the account level, such as the ability to create or delete instances in your IBM Cloud account.



Table 2. Lists platform management roles as they apply to Hyper Protect Crypto Services

 Action Viewer Editor Operator Administrator 

 View Hyper Protect Crypto Services instances. ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) ![checkmark icon](https://cloud.ibm.com/docs-content/v1/content/217f108cc44e2ce15fb692d4b57b4c628464e908/icons/checkmark-icon.svg) !
To review what the roles and allowed actions permit, see the following topics.



* [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions)
* [Red Hat OpenShift on IBM Cloud user access permissions](https://cloud.ibm.com/docs/openshift?topic=openshift-access_reference)
* Satellite-only: [Satellite IAM platform and service roles](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-access)



7. To change or assign new access policies, see [Assigning Red Hat OpenShift on IBM Cloud roles](https://cloud.ibm.com/docs/openshift?topic=openshift-usersadd_users) or [Assigning Satellite access](https://cloud.ibm.com/docs/satellite?topic=satellite-iam-assign-access).







 Checking IAM platform and service access roles from the CLI 



1. Log in to your IBM Cloud account. If you have a federated ID, include the --sso option.

ibmcloud login -r [--sso]
2. Find the User ID of the user whose permissions you want to check.

ibmcloud account users
3. Check the IAM access policies of the user.

ibmcloud iam user-policies <user_id>

Service access roles are synchronized with Kubernetes RBAC roles within your cluster. If you have a service access role, you might want to [verify your RBAC role](https://cloud.ibm.com/docs/openshift?topic=openshift-userschecking-rbac), too.
4. To review what the roles and allowed actions permit, see the following topics.



* [IAM roles and actions](https://cloud.ibm.com/docs/account?topic=account-iam-service-roles-actions)
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) 





Table 6. IAM platform roles for Activity Tracker Event Routing configuration actions

 Action IAM and Activity Tracker action Administrator Editor Operator Viewer 

 View configuration settings [V2] atracker.setting.get ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/bcd8b79ca2ed73bfcaefb20051f12cb6400286ab/icons/checkmark-icon.svg)
* To access IBM Cloud IAM by using the console, go to Manage > Access (IAM).
* Go to [Managing IAM access, API keys, service IDs, and access groups](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_iam) to review the available CLI commands.
* Go to the following API docs to review the available APIs:



* [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-api)
* [IAM Access Groups API](https://cloud.ibm.com/apidocs/iam-access-groups)
* [IAM Policy Management API](https://cloud.ibm.com/apidocs/iam-policy-management)
With trusted profiles, you manage the identities of your users within your own corporate directory. And, you can centrally manage the access lifecycle to multiple IBM Cloud accounts and assets for federated users without the need to configure access policies for each entity within each account. You don't need to invite users to your account to give them to access your IBM Cloud resources.

You can also define fine-grained authorization for all applications that are running in a compute resource without creating service IDs or managing the API key lifecycle for applications. To start creating trusted profiles for your organization, see [Trusted profiles for eliminating the need to manage credentials](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-access-management-overviewtrusted-profiles-feature).





 Resources 

Account resources are the service instances that are selected from the catalog or finer-grained resources within a service instance, such as an IBM Cloud® Object Storage bucket. IAM-enabled resources are added to a resource group when they are created from the catalog.

IAM access management enables fine-grained access, which means that a policy can be set on a wide scale to all resources in a resource group, for example, or to a specific service instance in the account and even a resource type like a IBM Cloud Object Storage bucket within a specific instance.





 Access policies 

Access policies are how users, [service IDs](https://cloud.ibm.com/docs/account?topic=account-serviceids), access groups, and trusted profiles in the account are given permission to access and take actions on account resources. Policies include a subject, target, and role. The subject is the user, service ID, or access group that you are providing access. The target of the policy is the resource to which you want to provide access. And, the IAM roles define the level of access or allowed actions on the target of the policy.

A policy assigns the subject one or more roles that define the level of access and one or more attributes that define the target that the policy allows access to.