Skip to content
TebibHost Docs

IAM policies

TebibHost’s identity and access management (IAM) works like AWS IAM: a policy is a JSON document that allows or denies actions on resources, optionally under conditions. You attach policies to principals (users, groups, service accounts and roles), for the whole organization or for one project. Nothing is allowed unless a policy allows it.

Managed policies

Section titled “Managed policies”

TebibHost maintains five policies you can attach as they are. They update automatically when new actions appear.

Policy What it allows
OrgOwner Everything in the organization, including IAM and billing
ProjectAdmin All compute, network and metering actions; update and delete projects (not create); no IAM or billing changes
ProjectMember Run workloads: VMs, volumes, snapshots, SSH keys, public IP allocation and association; read networks; no changes to VPCs, subnets or security groups
Billing Balances, transactions, top-ups, statements and billing contacts; nothing else
ReadOnly Describe and list everything it’s attached for

All of them let someone talk to Ogbai (assistant:Use), and all but ReadOnly let them confirm what it offers (assistant:ConfirmProposal). Neither grants anything else.

Attach ProjectAdmin, ProjectMember or ReadOnly with a project to limit them to that project; without one they apply to every project.

Terminal window
tebib iam attachment attach --policy ProjectMember --principal group/g-0123456789ab --project p-0123456789ab

Writing a policy

Section titled “Writing a policy”
web-operators.json
{
  "Version": "2026-10-08",
  "Statement": [
    {
      "Sid": "OperateWebVMs",
      "Effect": "Allow",
      "Action": ["compute:StartVM", "compute:StopVM", "compute:RebootVM", "compute:Describe*"],
      "Resource": "trn:tebib:compute:*:p-0123456789ab:vm/*",
      "Condition": {
        "StringEquals": { "resource:tag/team": "web" }
      }
    }
  ]
}
Terminal window
tebib iam policy create web-operators --document web-operators.json
Element Meaning
Version Always 2026-10-08
Statement One or more statements
Sid Optional name (letters and digits), shown when a decision is explained
Effect Allow or Deny. A Deny always wins
Action / NotAction service:Verb names; * and ? wildcards work (compute:Describe*)
Resource / NotResource Resource names (TRNs), with wildcards
Condition Optional tests on the request; all must pass

Every API endpoint lists the action it needs in the API reference. Actions are named after what they do: compute:CreateVM, compute:DescribeVM (get and list), network:AssociatePublicIp, billing:CreateTopUp.

Conditions

Section titled “Conditions”

Operators: StringEquals, StringNotEquals, StringEqualsIgnoreCase, StringNotEqualsIgnoreCase, StringLike, StringNotLike, the Numeric… and Date… families (Equals, NotEquals, LessThan, LessThanEquals, GreaterThan, GreaterThanEquals), IpAddress, NotIpAddress, TrnEquals, TrnLike, TrnNotEquals, TrnNotLike, Bool and Null. Prefix with ForAnyValue: or ForAllValues: for multi-valued keys; add IfExists to pass when the key is absent.

Key Value
auth:mfa true for a console sign-in that passed a second factor or a passkey; always false for access keys and role sessions
auth:source-ip The caller’s IP address
auth:current-time, auth:epoch-time When the request is made
auth:principal-trn, auth:principal-id, auth:principal-type Who is calling
auth:credential-type How they authenticated (for example access-key)
auth:organization-id, auth:region Where
auth:role-trn, auth:source-principal-trn For role sessions: the role, and who assumed it
resource:trn, resource:project-id The resource acted on
resource:tag/<key> A tag on the resource
request:tag/<key>, request:tag-keys Tags in a create or tag request
principal:tag/<key> A tag on the caller (set on members, service accounts and roles)

String and TRN values may use variables, such as ${principal:tag/team}, to write one policy for many teams.

Versions

Section titled “Versions”

A customer policy keeps up to 5 versions; one of them is the default, the one in force. Saving a new document makes a new version and (by default) the new default, so every attachment picks it up at once. Roll back with tebib iam policy set-default.

Terminal window
tebib iam policy version create web-operators -f web-operators.json
tebib iam policy version list web-operators

A document can be at most 6,144 characters.

How a request is decided

Section titled “How a request is decided”
  1. An explicit Deny anywhere that applies means deny.
  2. Otherwise the request is allowed only if every layer that applies allows it: the principal’s own policies (directly or through groups), every guardrail, the principal’s permission boundary if it has one, and the session policy for a role session.
  3. Otherwise it is denied (the default).

A denied request answers 403, and the error names the action and the resource.

Check before you change: the access checker

Section titled “Check before you change: the access checker”

Ask whether a principal may do something, and which statement decides, without trying it. The console’s IAM → Access check page does the same.

Terminal window
tebib iam simulate -p user/u-0123456789ab \
  -a compute:StartVM -a compute:DeleteVM \
  -r trn:tebib:compute:lab-neo-1:p-0123456789ab:vm/vm-0123456789ab \
  -c auth:mfa=true

Add --fail-on-deny in CI to exit with code 4 if anything is denied.