IBM IAM Service ID Builder

IAM & SecurityIBM Cloud

Build Service ID and API key configurations for programmatic access to IBM Cloud services.

Last verified: May 2026

IBM Cloud Identity and Access Management Configuration

Build Service ID configurations with API keys and access policies for programmatic access to IBM Cloud services.

Required Fields

nameaccountIdapiKeys

{
  "name": "my-app-service-id",
  "description": "Service ID for production application accessing COS and Db2",
  "accountId": "a1b2c3d4e5f6a1b2c3d4e5f6",
  "boundTo": "crn:v1:bluemix:public:::a/a1b2c3d4e5f6a1b2c3d4e5f6:::",
  "apiKeys": [
    {
      "name": "prod-api-key",
      "description": "Production API key for CI/CD pipeline",
      "storeValue": true,
      "locked": true
    },
    {
      "name": "dev-api-key",
      "description": "Development API key for local testing",
      "storeValue": false,
      "locked": false
    }
  ],
  "policies": [
    {
      "roles": ["Writer"],
      "resources": {
        "serviceName": "cloud-object-storage",
        "serviceInstance": "crn:v1:bluemix:public:cloud-object-storage:global:a/a1b2c3d4e5f6a1b2c3d4e5f6:instance-id-1234::",
        "resourceType": "bucket",
        "resource": "prod-data-bucket"
      }
    },
    {
      "roles": ["Editor"],
      "resources": {
        "serviceName": "dashdb-for-transactions",
        "serviceInstance": "crn:v1:bluemix:public:dashdb-for-transactions:us-south:a/a1b2c3d4e5f6a1b2c3d4e5f6:db-instance-5678::"
      }
    }
  ]
}

Generated Output

Output will appear here...

How This Tool Works

The builder collects the service ID name, description, scope (account or resource group), and attached access policies. For each policy it validates the role (Viewer, Editor, Administrator, or service-specific roles) against the chosen service and resource. Output is an `ibm_iam_service_id` Terraform resource plus `ibm_iam_service_policy` resources for each attached policy and an `ibm_iam_service_api_key` resource for the API key.

Overview

IBM Cloud Service IDs are non-human principals — like AWS IAM roles or GCP service accounts — used by applications, CI/CD pipelines, and scheduled jobs. The IBM IAM Service ID Builder produces complete service ID definitions including the principal, attached access policies, and API keys (with rotation guidance) so an application can authenticate without using a human user's credentials.

How Engineers Use This

•Creating a dedicated service ID for a CI/CD pipeline that deploys to IBM Cloud, with policies scoped to the resource group it manages.
•Generating a service ID for an application that needs to read from Cloud Object Storage and write to a Cloudant database with least-privilege policies.
•Replacing a human user's API key (which was being shared by an application) with a proper service ID so the human user's leaving doesn't break the integration.
•Documenting the service IDs in an account for an audit, including which resources each can access and when its API key was last rotated.

A Real Example

Your team's daily Jenkins job uses a shared 'cicd' user's API key to deploy to IBM Cloud. The user belongs to an engineer who is leaving in two weeks. You generate a proper service ID through the builder, attach narrowly-scoped policies that match what the pipeline actually needs (deploy to one resource group, no global admin), rotate the key into Jenkins' secret store, and remove the human user's account. Deploys keep working, the leaving engineer's departure is just a normal offboarding, and the audit trail is now keyed to a clearly-named service principal.

Tips & Gotchas

TIP

Rotate API keys at least quarterly, and immediately when a team member with knowledge of the key leaves. Treat any key older than 90 days as suspicious during audits.

TIP

Never check a service ID's API key into a git repo, even a private one. Store it in IBM Cloud Secrets Manager or your CI's secret store. A key in git is a key that has effectively leaked the moment the repo is cloned.

Questions & Answers

How long do service ID API keys live?

API keys have no built-in expiration on IBM Cloud — they live until explicitly deleted. This is a feature for stable applications and a bug for security: a key created two years ago has the same privileges as a fresh one. Establish a rotation policy and enforce it through tooling or scheduled audits.

Can a service ID assume another service ID?

Not directly. IBM Cloud uses Trusted Profiles for delegation: a service ID (or any IAM principal) can be authorized to assume a trusted profile, which itself carries access policies. This is closer to AWS IAM role assumption than to AWS IAM user impersonation. Use trusted profiles when an application needs different sets of permissions for different operations.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.