Dell ObjectScale 1.3 Administration Guide

An IAM Account contains other IAM entities like Users, Groups, Roles, Policies, and Service Providers associated with it. You cannot create or modify an Account to have another Account associated with it. Each account consists of replicated IAM entities and local IAM entities. Local IAM entities remain local within the ObjectScale instance and are not replicated. Global entities are replicated to other ObjectScale instances. Replicated IAM entities and local IAM entities have separate APIs.

IAM Identities

Table 1. Identities

Field	Description
Account root user	Account root user is an admin user in the account. Only the account root user can access the ObjectScale Portal user interface. Account root user is the owner of the buckets and any objects within created by its IAM entities.
IAM user	An IAM user is a person or an application in the account that can interact with ObjectScale resources. An IAM user can belong to one or more IAM groups. It is possible to create, view, modify, delete, and list IAM users in ObjectScale using both API and the ObjectScale Portal user interface. IAM users cannot access the ObjectScale Portal user interface.
IAM group	An IAM group is a collection of IAM users. IAM groups do not nest and contain only IAM users. IAM groups let you specify permissions for all the users in the group making management easier. Creating and managing groups can be done from both the ObjectScale Portal user interface and API. Tagging on groups is not supported.
IAM role	An IAM role is similar to a user, in that it is an identity with permission policies that determine what the identity can and cannot do. An IAM role does not have any credentials that are associated with it. An entity assumes a role by calling an API that provides it with temporary credentials to access a resource. A federated user can assume an IAM role by authenticating with external identity provider. An IAM user can assume a role in the same or different account (cross-account access).

Tagging IAM Entities (Users and Role)

A tag is a label that you assign to a resource. Each tag consists of a key and an optional value, both of which you define. Custom attributes are added to users and roles using a tag key-value pair. These tags can be used to control the access of an entity to resources or to control what tags can be attached to an entity. Groups and policies cannot be tagged. You can apply the same tag to multiple entities. But multiple tags on one entity cannot have the same key. Fifty tags per IAM entity are allowed.