Users, groups and invitations

People in an organization are users. Each has their own sign-in and their own access keys; an organization never shares passwords. You give access by attaching policies to users or, better, to groups of users.

Invite someone

Console

IAM → Invitations → Invite, enter their email, and pick the groups they should join.

CLI

tebib invitation create amina@example.com --group g-0123456789ab
tebib invitation list

They get an email with a link, valid for 7 days. Someone new creates their account from the link; someone who already has a TebibHost account accepts it while signed in. Revoke a pending invitation and its link stops working: tebib invitation revoke <invitation ID>.

A new member has no permissions until a policy is attached to them or to one of their groups.

Groups

A policy attached to a group applies to every member. Typical groups:

Group	Policy	Scope
admins	OrgOwner	Organization
developers	ProjectAdmin	One project each, or the organization
operators	ProjectMember	The projects they run
finance	Billing	Organization
auditors	ReadOnly	Organization

G=$(tebib -o json iam group create developers | jq -r .id)
tebib iam group add-member "$G" u-0123456789ab
tebib iam attachment attach --policy ProjectAdmin --principal "group/$G" --project p-0123456789ab

Tags on members

Tags on a member (for example team=web) are visible to policies as principal:tag/team, so one policy can let each team manage only resources carrying its own tag:

tebib iam user update u-0123456789ab --tag team=web

Removing someone

tebib iam user remove <user ID> (or IAM → Users → Remove) takes them out of the organization: their access and their access keys for it go at once. Their TebibHost account stays, with any other organizations they belong to.

An organization must keep at least one owner.