Skip to content
Origin Cloud Docs

IAM / Overview

What is Origin Cloud IAM?

Updated · 3 min read

IAM controls who can do what in your Origin Cloud organization. Learn how principals, roles, role assignments and permissions fit together.

On this page5 sections

IAM (Identity and Access Management) controls who can do what in your organization. You give people and automation access by assigning them built-in roles, either across the whole organization or for one project. Every API request is checked against those assignments, so you can also ask in advance whether a request will be allowed.

A principal is a user or a service account. A role assignment gives a principal one role, either org-wide or for a single project. The role is a fixed set of permissions, and each permission allows one action, such as compute.instance.launch, on resources inside the assignment's scope. For the details, see Access model.

Features

  • Built-in roles: Owner, Viewer, IAM Editor and three billing roles, each with a fixed set of permissions. See Built-in roles.
  • Role assignments: Grant a role to a user or service account org-wide or for one project, and revoke it again. See Assign and revoke roles.
  • Organization members: Invite people by email, list who has access, and remove a member's access in one step. See Manage organization members.
  • Service accounts: Non-interactive credentials for CI pipelines, scripts and infrastructure-as-code tools, with their own principal and roles. See Service accounts.
  • Access checks: Look up your own grants, list available permissions, and check whether a principal holds a permission on a resource. See Check access.
  • Audit log: A record of who changed access in your organization and when. See Audit log.

Ways to access IAM

  • CLI: The origin iam command group. See CLI access to install and sign in, and origin iam commands for every command.
  • GraphQL API: IAM queries and mutations live under the iam namespace of the API. See API access and the IAM reference for the list of operations.

Limitations

  • Custom roles aren't supported. You can assign and revoke the built-in roles only.
  • Groups aren't principals. The API lists three built-in groups by name and description, but you can't add members to a group or assign a role to one.
  • Role assignments are unconditional. You can't restrict a grant to a time window or an extra attribute check.
  • A service account's access is the union of its roles. You can't narrow one credential to a subset of what its roles allow.
  • Service accounts authenticate against the platform's own identity provider only. Federation with an external identity provider isn't supported.

For quotas, see Limits.

Next steps