For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.us.ovhcloud.com/en/account/account-information/iam-console-access.md.
  • English

Creating an IAM policy to allow users access to the OVHcloud Control Panel

View as Markdown

Learn how to provide a user with the minimum rights to allow them to log in to the OVHcloud Control Panel.

 

Requirements

 

Instructions

To be able to log in to the OVHcloud Control Panel, a user should have at least this set of rights on the account resource:

  • account:apiovh:me/get
  • account:apiovh:me/certificates/get
  • account:apiovh:me/tag/get

With these rights, a user will be able to log in to the OVHcloud Control Panel. To be able to perform any actions inside the Control Panel, additional rights have to be assigned through IAM.

 

Using the OVHcloud Control Panel

From the OVHcloud Control Panel, navigate to the Policies section via the Identity, Security & Operations menu and click Create a policy.

Policies tab - IAM control panel access

Set up a policy with the following configuration:

  • Provide a Policy name.

    Policies tutorial - IAM control panel access - step 1

  • Choose OVHcloud customer account as the Product type.

  • Select your account (i.e., xx1111-ovh) as the Resource.

    Policies tutorial - IAM control panel access - step 2

  • Add each of the following three rights as an Action.

    • account:apiovh:me/get
    • account:apiovh:me/certificates/get
    • account:apiovh:me/tag/get

    Policies tutorial - IAM control panel access - step 3

You can now link your users to this policy to give them the right to log in to the OVHcloud Control Panel.

Info

If you plan to use additional policies, it is not necessary to give any additional permissions.

Danger

WARNING: Any user with an "ADMIN" role has complete control over your account and services, including:

  • Creating services for which you will be charged,
  • Deleting services, which is sometimes irreversible,
  • Adding or deleting other users with an ADMIN role, and
  • Changing the account's contact, billing, and payment information.

 

Using API

Using the API, you can set up a policy according to the following example:

{
  "name": "manager_ro",
  "description": "manager_ro",
  "identities": [
    .... 
  ],
  "resources": [ 
     {
         "urn": "urn:v1:us:resource:account:xx1111-ovh" 
     }],
  "permissions": {
    "allow": [
      {
        "action": "account:apiovh:me/get"
      },
      {
        "action": "account:apiovh:me/certificates/get"
      },
      {
        "action": "account:apiovh:me/tag/get"
      }
    ]
  }
}

 

Go further

Browse all the Account information guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.