Concepts

IAM (Identity and Access Management) is a free product for all Cloud users. It enables flexible, fine-grained management of users, teams, organizations, projects, and resources.

Our IAM system uses Relationship-Based Access Control (ReBAC), organizing permissions based on relationships between users and cloud resources. This modern approach extends classic paradigms like role-based access control (RBAC), suiting dynamic cloud environments.

IAM uses OpenFGA, a CNCF project providing a declarative authorization language and runtime.

Free Product

IAM is available at no cost to all Cloud users.

Key Concepts

Organizations, Projects & Resources

Uses a three-tiered hierarchical model:

• Organizations(../usage/organizations.md)

  Top-level entity

  ---

  • Container for all cloud assets
  • Represents a business organization or major division
  • Users can own, administer or join any number of organizations
  • Defines overarching cloud policies and permissions
  • Billed as a single entity

  Find Out More

• Projects(../usage/projects.md)

  Middle Management Layer

  ---

  • Sub-containers within organizations
  • Represent units like dev or stage environments
  • Enable fine-grained access control and resource isolation

  Find Out More

• Resources(../usage/organizations.md)

  Operational Core

  ---

  • Tangible elements: VMs, networks, storage, Kubernetes clusters, databases, and so on
  • Allocated to specific Projects
  • Where cloud infrastructure management occurs
  • Authorization based on Project Permissions

  Find Out More

Users

Users in IAM authenticate using a username and password. They can then manage resources they have access to, across organizations and projects.

• Exist as a single identity on the platform, regardless of the organization(s) they belong to
• Access controlled through fine-grained permissions

Teams

Teams group organization-scoped users to simplify management of access to projects and resources.

For more information, visit the Teams section.

Service Accounts

Service Accounts are organization-scoped machine identities. Service Accounts authenticate against our APIs to access and manage resources.

• Scoped to a specific organization
• Users or other service accounts can create and manage them
• Flexible configuration of organization and project permissions
• Support any number of credentials

For details, see the Service Accounts section.

(deprecated) API Keys

API keys enable programmatic access to Cloud:

• Scoped to a specific project
• Users, possibly through a team, can create and manage them
• Receive project permissions once during creation, single credential
• Revocable at any time

For details, see the API Keys section.

Advanced Topics

Connecting External IdPs

We support connecting external identity providers (IdPs), allowing users to authenticate with existing credentials. For more information, head to Connect Your IdP.

Understanding ReBAC and Fine-Grained Permissions

Note: The terms permissions and relations mean the same thing.

This diagram shows a simplified representation of user-organization relationships:

Key points:

• UserA has direct relations to OrgA
• UserB has direct relations to both OrgA and OrgB
• UserC has direct relations within OrgB alone

This shows explicit permissions. Users can also inherit permissions; for example, an organization Owner has implicit full access to all projects within that organization.

Fine-grained Permissions in Detail

This diagram illustrates permission evaluation in IAM:

Key points:

• UserA, as owner of OrgA, has full access to all OrgA resources
  • Exemplified by the implied can_assign_permissions relation in ProjectA.1
• UserA assigned can_administrate_project to UserB in ProjectA.2
• UserB has can_read_project for ProjectA.2 via two paths: OrgA membership and direct can_administrate_project relation