Problem:
GET /v1/policies?account_id=...&type=access lists a policy created with POST /v2/policies (for example one with a time condition) as a placeholder: subject iam_id "unsupported version", one role "role:UnsupportedVersion" ("This is a unsupported policy version placeholder, to view the full content, please call GET with provided href"), only accountId as resource, and an href under /v2/policies/ID. GET /v1/policies/ID answers 404 for it. To see every policy of an account, a client has to list v1, detect the placeholders and read each one again through v2.
Use case:
We audit and operate client accounts from our own tooling: list every access policy, show who can reach what, review changes. Every placeholder costs an extra call, and a client that does not know about the placeholder silently misses conditional policies - exactly the ones that need review.
Request:
One listing endpoint that returns every access policy of the account, v1 and v2, in full (subject, resource attributes with operators, roles, conditions), with the same paging.
| Idea priority | Medium |
| Needed By | Yesterday (Let's go already!) |
By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.