tebib iam

Generated from the CLI's own command tree. Run tebib iam --help for the same text in your terminal.

Identity and access management: who may do what in an organization.

Commands

tebib iam credential-report

Every user, service account and role with its last activity, and every access key.

tebib iam credential-report [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam credential-report                                   # every principal's last activity and keys

tebib iam simulate

Would a principal be allowed? Checks every action on every resource with the same rules as real requests and names the policy statements that decide.

tebib iam simulate [OPTIONS]

Option	Value	Description
--principal, -p required	str	TRN, or user/<id>, service-account/<id>, role/<id>, role-session/<id>.
--action, -a required	str (repeatable)	Action to check, e.g. compute:StartVM (repeatable).
--resource, -r required	str (repeatable)	Resource TRN; '<type>/*' checks a create (repeatable).
--context, -c	KEY=VALUE (repeatable)	Request key to simulate, KEY=VALUE (repeatable): auth:mfa=true, auth:source-ip=..., auth:current-time=..., auth:credential-type=access-key, resource:tag/<key>=..., request:tag/<key>=...
--session-policy	FILE	Roles only: a session policy JSON file (or -), as if passed to role assume.
--fail-on-deny	flag	Exit 4 if any pair is denied (for CI checks).
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam simulate -p user/u-... -a compute:StartVM -a compute:DeleteVM -r trn:tebib:compute:lab-neo-1:p-...:vm/vm-... -c auth:mfa=true        # allowed? by which statement?

tebib iam attachment

Which policies are attached to which principals, and where.

tebib iam attachment attach

Attach a policy to a user, group, service account or role.

tebib iam attachment attach [OPTIONS]

Option	Value	Description
--policy required	str	Policy ID, name or TRN.
--principal required	str	TRN, or user/<id>, group/<id>, ...
--project, -p	str	Limit the policy to this project (default: the whole organization).
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam attachment attach --policy ProjectAdmin --principal group/g-... --project p-...

tebib iam attachment detach

Detach a policy (its permissions go at once).

tebib iam attachment detach [OPTIONS] ATTACHMENT_ID

Argument	Description
ATTACHMENT_ID required	Attachment ID.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam attachment list

List policy attachments.

tebib iam attachment list [OPTIONS]

Option	Value	Description
--principal	str	Only this principal (TRN or <kind>/<id>).
--policy	str	Only this policy (ID, name or TRN).
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

tebib iam boundary

Permission boundaries: one policy per user, service account or role that caps its identity policies (it grants nothing by itself).

tebib iam boundary list

List permission boundaries.

tebib iam boundary list [OPTIONS]

Option	Value	Description
--principal	str	Only this principal (TRN or <kind>/<id>).
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

Examples

tebib iam boundary list | remove --principal role/r-...

tebib iam boundary remove

Remove a principal's permission boundary (its policies apply in full again).

tebib iam boundary remove [OPTIONS]

Option	Value	Description
--principal required	str	TRN, or user/<id>, service-account/<id>, role/<id>.
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

Examples

tebib iam boundary list | remove --principal role/r-...

tebib iam boundary set

Set or replace a principal's permission boundary.

tebib iam boundary set [OPTIONS]

Option	Value	Description
--principal required	str	TRN, or user/<id>, service-account/<id>, role/<id>.
--policy required	str	Policy ID, name or TRN.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam boundary set --principal service-account/sa-... --policy ReadOnly

tebib iam group

Groups of users; policies attached to a group apply to its members.

tebib iam group add-member

Add a member to a group.

tebib iam group add-member [OPTIONS] GROUP_ID USER_ID

Argument	Description
GROUP_ID required	Group ID (g-...).
USER_ID required	User ID (u-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).

Examples

tebib iam group add-member g-... u-...

tebib iam group create

Create a group.

tebib iam group create [OPTIONS] NAME

Argument	Description
NAME required	Group name (letters, digits, +=,.@_-).

Option	Value	Description
--description	str	Description.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam group create devs

tebib iam group delete

Delete a group (members lose the permissions it gave them).

tebib iam group delete [OPTIONS] GROUP_ID

Argument	Description
GROUP_ID required	Group ID (g-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam group list

List groups.

tebib iam group list [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

tebib iam group members

List a group's members.

tebib iam group members [OPTIONS] GROUP_ID

Argument	Description
GROUP_ID required	Group ID (g-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam group remove-member

Remove a member from a group.

tebib iam group remove-member [OPTIONS] GROUP_ID USER_ID

Argument	Description
GROUP_ID required	Group ID (g-...).
USER_ID required	User ID (u-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam group show

Show a group.

tebib iam group show [OPTIONS] GROUP_ID

Argument	Description
GROUP_ID required	Group ID (g-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam group update

Change a group's description.

tebib iam group update [OPTIONS] GROUP_ID

Argument	Description
GROUP_ID required	Group ID (g-...).

Option	Value	Description
--description required	str	New description.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam guardrail

Organization guardrails: policies that cap every principal, OrgOwners included. With none attached there is no limit; with several, each must allow a request. They never grant anything, and never limit iam:*Guardrail* actions.

tebib iam guardrail attach

Attach a policy as a guardrail. It caps EVERY principal in the organization, owners included, at once: check it first with tebib iam simulate.

tebib iam guardrail attach [OPTIONS] POLICY

Argument	Description
POLICY required	Policy ID, name or TRN.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam guardrail attach no-deletes                          # caps EVERYONE, owners included

tebib iam guardrail detach

Detach a guardrail (its limits go at once). Guardrails never block this.

tebib iam guardrail detach [OPTIONS] GUARDRAIL_ID

Argument	Description
GUARDRAIL_ID required	Guardrail ID (grd-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

Examples

tebib iam guardrail list | show grd-... | detach grd-...       # detach is never blocked by guardrails

tebib iam guardrail list

List the organization's guardrails.

tebib iam guardrail list [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

Examples

tebib iam guardrail list | show grd-... | detach grd-...       # detach is never blocked by guardrails

tebib iam guardrail show

Show a guardrail.

tebib iam guardrail show [OPTIONS] GUARDRAIL_ID

Argument	Description
GUARDRAIL_ID required	Guardrail ID (grd-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam guardrail list | show grd-... | detach grd-...       # detach is never blocked by guardrails

tebib iam policy

JSON permission policies and their versions.

tebib iam policy create

Create a customer policy from a JSON document.

tebib iam policy create [OPTIONS] NAME

Argument	Description
NAME required	Policy name (letters, digits, +=,.@_-).

Option	Value	Description
--document, -f required	FILE	Policy JSON file, or - for stdin.
--description	str	Description.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam policy create readers --document policy.json      # or -f - (stdin)

tebib iam policy delete

Delete a customer policy (detach it everywhere first).

tebib iam policy delete [OPTIONS] POLICY

Argument	Description
POLICY required	Policy ID (pol-...) or name.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam policy list

List policies.

tebib iam policy list [OPTIONS]

Option	Value	Description
--scope	str	all, local (yours) or managed (TebibHost's). Default: all.
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

Examples

tebib iam policy list --scope managed

tebib iam policy set-default

Make a version the one in force.

tebib iam policy set-default [OPTIONS] POLICY VERSION

Argument	Description
POLICY required	Policy ID (pol-...) or name.
VERSION required	Version number.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam policy show

Show a policy (the table omits the document; use --document or -o json).

tebib iam policy show [OPTIONS] POLICY

Argument	Description
POLICY required	Policy ID (pol-...) or name.

Option	Value	Description
--document	flag	Print only the default version's document.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam policy show readers --document

tebib iam policy update

Change a policy's description (the document changes through new versions).

tebib iam policy update [OPTIONS] POLICY

Argument	Description
POLICY required	Policy ID (pol-...) or name.

Option	Value	Description
--description required	str	New description.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam policy version create

Save a new version of a policy's document.

tebib iam policy version create [OPTIONS] POLICY

Argument	Description
POLICY required	Policy ID (pol-...) or name.

Option	Value	Description
--document, -f required	FILE	Policy JSON file, or - for stdin.
--set-default, --no-set-default	flag	Make it the version in force.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam policy version create readers -f policy.json        # new default version

tebib iam policy version delete

Delete a version that isn't the default (its number is never reused).

tebib iam policy version delete [OPTIONS] POLICY VERSION

Argument	Description
POLICY required	Policy ID (pol-...) or name.
VERSION required	Version number.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam policy version list

List a policy's versions.

tebib iam policy version list [OPTIONS] POLICY

Argument	Description
POLICY required	Policy ID (pol-...) or name.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam policy version show

Print one version's document.

tebib iam policy version show [OPTIONS] POLICY VERSION

Argument	Description
POLICY required	Policy ID (pol-...) or name.
VERSION required	Version number.

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam role

Roles that trusted principals assume for short-lived sessions.

tebib iam role assume

Get short-lived credentials for a role (if its trust policy allows you).

tebib iam role assume [OPTIONS] ROLE_ID

Argument	Description
ROLE_ID required	Role ID (role-...).

Option	Value	Description
--session-name required	str	Shows in the audit log (2-64 chars: letters, digits, +=,.@_-).
--duration	int range	Session length in seconds (default 1 h).
--policy, -f	str	Session policy JSON file (or -): narrows what the role allows.
--export	flag	Print shell export lines for the credentials.
--save-profile	NAME	Save the session as this profile (endpoint and organization copied).
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam role create

Create a role. Attach policies to it with tebib iam attachment attach.

tebib iam role create [OPTIONS] NAME

Argument	Description
NAME required	Role name (letters, digits, +=,.@_-).

Option	Value	Description
--trust-policy, -f required	str	Trust policy JSON file, or - for stdin.
--description	str	Description.
--max-session	int range	Longest session in seconds (900-43200). Default: 3600.
--tag	KEY=VALUE (repeatable)	Tag as KEY=VALUE; repeat for more tags.
--permission-boundary	str	Cap this principal with a policy (ID, name or TRN): its policies then grant only what the boundary also allows.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam role create deployer --trust-policy trust.json --max-session 3600
tebib iam role create ci --trust-policy trust.json --permission-boundary ReadOnly

tebib iam role delete

Delete a role (its sessions end).

tebib iam role delete [OPTIONS] ROLE_ID

Argument	Description
ROLE_ID required	Role ID (role-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam role list

List roles.

tebib iam role list [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

tebib iam role revoke-sessions

End every session of a role now (e.g. after a leak).

tebib iam role revoke-sessions [OPTIONS] ROLE_ID

Argument	Description
ROLE_ID required	Role ID (role-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam role show

Show a role and its trust policy.

tebib iam role show [OPTIONS] ROLE_ID

Argument	Description
ROLE_ID required	Role ID (role-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam role update

Change a role's trust policy, description, session length or tags.

tebib iam role update [OPTIONS] ROLE_ID

Argument	Description
ROLE_ID required	Role ID (role-...).

Option	Value	Description
--trust-policy, -f	str	New trust policy file, or -.
--description	str	New description.
--max-session	int range	Longest session in seconds.
--tag	KEY=VALUE (repeatable)	Replace ALL tags (KEY=VALUE, repeatable).
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam service-account

Non-human identities for CI and automation.

tebib iam service-account create

Create a service account (then: tebib key create --service-account <id>).

tebib iam service-account create [OPTIONS] NAME

Argument	Description
NAME required	Name, unique in the organization.

Option	Value	Description
--description	str	Description.
--tag	KEY=VALUE (repeatable)	Tag as KEY=VALUE; repeat for more tags.
--permission-boundary	str	Cap this principal with a policy (ID, name or TRN): its policies then grant only what the boundary also allows.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam service-account create ci --tag team=web

tebib iam service-account delete

Delete a service account and its access keys.

tebib iam service-account delete [OPTIONS] SA_ID

Argument	Description
SA_ID required	Service account ID (sa-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

tebib iam service-account list

List service accounts.

tebib iam service-account list [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

tebib iam service-account show

Show a service account.

tebib iam service-account show [OPTIONS] SA_ID

Argument	Description
SA_ID required	Service account ID (sa-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam service-account update

Change a service account's description, tags or status.

tebib iam service-account update [OPTIONS] SA_ID

Argument	Description
SA_ID required	Service account ID (sa-...).

Option	Value	Description
--description	str	New description.
--tag	KEY=VALUE (repeatable)	Replace ALL tags (KEY=VALUE, repeatable).
--disable, --enable	flag	Refuse (or accept again) its access keys.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam settings

Credential rules: key lifetimes and the unused-key limit.

tebib iam settings set

Change the unused-key limit (pass --unused-key-days N or --no-unused-key-limit).

tebib iam settings set [OPTIONS]

Option	Value	Description
--unused-key-days	int range	Turn off active access keys unused for this many days.
--no-unused-key-limit	flag	Never turn off unused access keys.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam settings set --unused-key-days 60                   # or --no-unused-key-limit (default 90)

tebib iam settings show

Show the organization's credential rules.

tebib iam settings show [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

tebib iam user

Organization members.

tebib iam user list

List the organization's members.

tebib iam user list [OPTIONS]

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--limit	int range	Show at most this many items.
--output, -o	table | json | yaml	Output format.

Examples

tebib iam user list | show | update --tag k=v | remove

tebib iam user remove

Remove a member from the organization (their keys go, their account stays).

tebib iam user remove [OPTIONS] USER_ID

Argument	Description
USER_ID required	User ID (u-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--yes, -y	flag	Don't ask for confirmation.

Examples

tebib iam user list | show | update --tag k=v | remove

tebib iam user show

Show one member.

tebib iam user show [OPTIONS] USER_ID

Argument	Description
USER_ID required	User ID (u-...).

Option	Value	Description
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam user list | show | update --tag k=v | remove

tebib iam user update

Set a member's tags (policies see them as principal:tag/<key>) and/or permission boundary.

tebib iam user update [OPTIONS] USER_ID

Argument	Description
USER_ID required	User ID (u-...).

Option	Value	Description
--tag	KEY=VALUE (repeatable)	Replace ALL tags (KEY=VALUE, repeatable).
--clear-tags	flag	Remove all tags.
--permission-boundary	str	Cap this principal with a policy (ID, name or TRN): its policies then grant only what the boundary also allows.
--org	str	Organization ID (default: from the profile).
--output, -o	table | json | yaml	Output format.

Examples

tebib iam user list | show | update --tag k=v | remove