---
title: "Creating an IAM policy to allow users access to the OVHcloud Control Panel"
description: "Learn how to provide a user with the minimum rights to allow them to log in to the OVHcloud Control Panel."
url: https://docs.us.ovhcloud.com/en/account/account-information/iam-console-access
lang: en
---
> For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt.

# Creating an IAM policy to allow users access to the OVHcloud Control Panel

**Learn how to provide a user with the minimum rights to allow them to log in to the OVHcloud Control Panel.**

 

## Requirements

- An [OVHcloud account](https://manager.us.ovhcloud.com/#/hub)
- Knowing [how to manage account users](https://docs.us.ovhcloud.com/en/account/account-information/manage-local-users.md)
- Knowing [how to set up policies for IAM](https://docs.us.ovhcloud.com/en/account/account-information/use-iam-policies-console.md)

 

## Instructions

To be able to log in to the OVHcloud Control Panel, a user should have at least this set of rights on the account resource:

- `account:apiovh:me/get`
- `account:apiovh:me/certificates/get`
- `account:apiovh:me/tag/get`

With these rights, a user will be able to log in to the OVHcloud Control Panel. To be able to perform any actions inside the Control Panel, additional rights have to be assigned through IAM.

 

### Using the OVHcloud Control Panel

From the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/), navigate to the Policies section via the Identity, Security & Operations menu and click Create a policy.

Set up a policy with the following configuration:

- Provide a **Policy name**.

- Choose `OVHcloud customer account` as the **Product type**.

- Select your account (i.e., `xx1111-ovh`) as the **Resource**.

- Add each of the following three rights as an **Action**.

  - `account:apiovh:me/get`
  - `account:apiovh:me/certificates/get`
  - `account:apiovh:me/tag/get`

You can now link your users to this policy to give them the right to log in to the OVHcloud Control Panel.

**Note:**

If you plan to use additional policies, it is not necessary to give any additional permissions.

**Important:**

**WARNING:** Any user with an "ADMIN" role has complete control over your account and services, including:

- Creating services for which you will be charged,
- Deleting services, which is sometimes irreversible,
- Adding **or deleting** other users with an ADMIN role, and
- Changing the account's contact, billing, and payment information.

 

### Using API

Using the API, you can set up a policy according to the following example:

```json
{
  "name": "manager_ro",
  "description": "manager_ro",
  "identities": [
    .... 
  ],
  "resources": [ 
     {
         "urn": "urn:v1:us:resource:account:xx1111-ovh" 
     }],
  "permissions": {
    "allow": [
      {
        "action": "account:apiovh:me/get"
      },
      {
        "action": "account:apiovh:me/certificates/get"
      },
      {
        "action": "account:apiovh:me/tag/get"
      }
    ]
  }
}
```

 

## Go further

- [How to restrict local users from billing information in the OVHcloud Control Panel](https://docs.us.ovhcloud.com/en/account/account-information/restrict-local-users-from-billing-information.md)

Browse all the [Account information guides](https://docs.us.ovhcloud.com/en/account/account-information/landing-page-account-information.md).

Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services.