With the latest feature release from IBM Cloud Identity and Access Management (IAM), you can customize how access is assigned to individual services by creating custom roles in your account.

Until now, access was managed by using the available platform and service roles that have specific actions that are mapped by individual services. In many cases, to get the desired access for your users, you had to evaluate all of the roles and their associated actions and sometimes assign more than one role. However, now you can simplify the access assignment process by customizing which actions you want users to have and combining them into a single role.

What is a custom role?

A custom role is a collection of actions that are chosen by an administrator and scoped to a single service for giving users access. This means that you must select a single service and choose the actions that you want to add from that service. You can’t combine actions from different services into a custom role. 

You can add any number of the available actions for the service that you select, give the custom role a unique name, and add it to the account. After the custom role is created, any user who can assign access to that particular service can select it or specify it the next time that they assign access in the console or by using the CLI or API.

Who can manage custom roles?

There is a new account management service that is called Role management that can be used to give users access to manage custom roles. Account owners can create, update, and delete custom roles by default, but if you want another user in your account to be able to do the same, you must assign them access to the new account management service:

  • The Editor role on the Role management service enables users to edit and update a role name, description, and the actions that are mapped to it.
  • The Administrator role on the Role management service enables users to create, edit, update, and delete custom roles in the account.

Creating custom roles

When you’re ready to create your first custom role to simplify how access is assigned to IBM Cloud services in your account, you can get started in the IAM section of the console.

  1. Go to Manage > Access (IAM) and then click Roles
  2. Click Create +.
  3. Enter a unique name for your role that is displayed in the console when users assign access to the service. 
  4. Enter an ID for the role that is used to create the CRN for the role, which is used when assigning access by using the API. 
  5. Optional: A role description can also be included. A description can be helpful for users assigning access because it displays with the role name in the console and can help provide information about the role to the users. 
  6. Select a service to start reviewing what actions you want to add to your role.
  7. Click Add next to each action that you want for your custom role. You must select at least one action that is defined by the service, so check the Type column for all actions labeled Service, and make sure you add at least one.
  8. When you’re done, review the role summary. Then, click Create.

When you’re ready to start trying it out, log in to your account and go to the Roles page.


More from Announcements

IBM TechXchange underscores the importance of AI skilling and partner innovation

3 min read - Generative AI and large language models are poised to impact how we all access and use information. But as organizations race to adopt these new technologies for business, it requires a global ecosystem of partners with industry expertise to identify the right enterprise use-cases for AI and the technical skills to implement the technology. During TechXchange, IBM's premier technical learning event in Las Vegas last week, IBM Partner Plus members including our Strategic Partners, resellers, software vendors, distributors and service…

Introducing Inspiring Voices, a podcast exploring the impactful journeys of great leaders

< 1 min read - Learning about other people's careers, life challenges, and successes is a true source of inspiration that can impact our own ambitions as well as life and business choices in great ways. Brought to you by the Executive Search and Integration team at IBM, the Inspiring Voices podcast will showcase great leaders, taking you inside their personal stories about life, career choices and how to make an impact. In this first episode, host David Jones, Executive Search Lead at IBM, brings…

IBM watsonx Assistant and NICE CXone combine capabilities for a new chapter in CCaaS

5 min read - In an age of instant everything, ensuring a positive customer experience has become a top priority for enterprises. When one third of customers (32%) say they will walk away from a brand they love after just one bad experience (source: PWC), organizations are now applying massive investments to this experience, particularly with their live agents and contact centers.  For many enterprises, that investment includes modernizing their call centers by moving to cloud-based Contact Center as a Service (CCaaS) platforms. CCaaS solutions…

See what’s new in SingleStoreDB with IBM 8.0

3 min read - Despite decades of progress in database systems, builders have compromised on at least one of the following: speed, reliability, or ease. They have two options: one, they could get a document database that is fast and easy, but can’t be relied on for mission-critical transactional applications. Or two, they could rely on a cloud data warehouse that is easy to set up, but only allows lagging analytics. Even then, each solution lacks something, forcing builders to deploy other databases for…