Assign or remove access for an identity

You can add or remove roles and permissions individually or in bulk. These operations can be carried out through the portal or through the API. An API for ACL (Access Control List) lets you associate ACL with resources in order to finely tune which accounts are allowed to carry out operations on them.

Prerequisites

• An account with the permissions required to manage ACL (IAM.getPolicy and IAM.setPolicy)
• A connection token associated with the Numspot account used: Documentation link - obtain a token
• The identifier of the organization or the space
• The identifier (UUID) of the resource

Permissions

info

This action requires the following IAM (Identity and Access Management) permissions:

• iam.permission.get

Console

1 / 3From the left-hand side menu, click IAM → Users.

1 / 3

In the IAM Identity and access dashboard, click the Actions drop-down menu of the user, and select the Manage roles option.

tip

You can assign one or more roles at once.

API

You can add or remove roles and permissions individually or in bulk. You must know the UUID (Universally Unique Identifier) of the items to add or remove.

Example for a space

export REGION="myregion"
curl -X 'PATCH' \
  'https://api.$REGION.numspot.cloud/iam/spaces/{spaceId}/iampolicy/users/b7bdb002-e737-46a6-b282-f5fe55aad110' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json' \
  -d '{
  "add": {
    "roles": [
      "208f2800-574d-4c24-a84c-c341019fd351"
    ],
    "permissions": [
      "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    ]
  }
}'

ACL or granular permissions

The ACL (Access Control List) mechanism lets you finely assign permissions to a user on a resource.

A set of API lets you carry out the create, delete and list operations for the ACL of a user. The API follows the general behavior of the Numspot API:

• you can address a user account or a service account.

The items to provide are:

Associate an ACL with a resource

{
  "items": [
    {
      "service": "string",
      "resource": "string",
      "subresource": "string",
      "resourceId": "string",
      "permissionId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ]
}

The request will look like this:

Example:openshift.cluster.get

export REGION="myregion"
curl -X 'POST' \
  'http://api.$REGION.numspot.cloud/iam/organisations/{organisationId}/serviceAccounts/b85743e8-3f68-4341-a6ce-0df969cfd7bf/bulk/acl' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json' \
  -d '{
  "items": [
    {
      "service": "openshift",
      "resource": "cluster",
      "resourceId": "05414b98-5226-4ecd-acc8-6417e9e24a40",
      "permissionId": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
    }
  ]
}

info

Items being a list-type field. You can manipulate several ACL in a single request.

See the page on using the API for the implementation.

The rights and permissions are assigned to the user associated with the userId of the request.

The API can address both user accounts (users) and service accounts (serviceAccounts).

Example for a service account

https://..../iam/organisations/{organisationId}/serviceAccounts/3abcfff1-97fa-4016-832d-f63852e87bac/bulk/acl'