17
VOTE
Status
Not under consideration
Workspace
* IBM Cloud Ideas
Categories
Account Management
Created by
Guest
Created on
Aug 1, 2022
RELATED IDEAS
We need a REST and CLI interface to generate API keys for the account owner and other functional/service IDs.
I am part of a team that manages over 1 hundred IBM Cloud accounts and counting. We have automated all the steps of configuring a new account, e.g., resource groups, access groups, access policies, inviting users. But creating an API key requires a manual step using the UI. We need a REST API and CLI to automate this step. In order to scale to the level of IBM Cloud usage we are targeting we need account management to be fully automated.
| Idea priority | High |
| Needed By | Yesterday (Let's go already!) |
By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.
While the automation need is understandable, this introduces the risk of potentially expose the admins api key at account creation time if returned without authentication, and also possibly leading to sharing of the key between users. There are also conflicts that could potentially arise with default IAM settings at account creation (e.g. MFA)
I would think to help with automation, when using the API's to generate an Enterprise Sub Account, the identified owner of the new account should automatically have an API Key generated, which is returned in the output when the sub account is created. Today, you generate the sub account, then manually log into that account via the CLI using the --sso option or through the web console, then generate a new API key. Only then can you use that API key to automate the rest of the account setup. We're trying to skip that middle step.
Yes, we are aware of the IAM API for creating an API key. But that requires authentication of the caller.
To clarify the scenario, the issue arrises at the time of account creation. The only user that exists is the account owner and the creation of its API key is not automated.
IAM does provide an API to create API keys https://cloud.ibm.com/apidocs/iam-identity-token-api#create-api-key
Could you please provide more detail to help better understand this?