--- title: "IAM for Logs Data Platform - Presentation and FAQ" description: "Learn about the integration of Logs Data Platform with OVHcloud IAM." url: https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/iam-presentation-faq lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # IAM for Logs Data Platform - Presentation and FAQ **Learn about the integration of Logs Data Platform with OVHcloud IAM.** **Note:** IAM for Logs Data Platform will be available starting **September 17, 2025**. The content of this documentation will be valid from this date.   ## Requirements - An [OVHcloud account](https://docs.us.ovhcloud.com/en/account/account-information/create-account.md) - Access to the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/) - A [Logs Data Platform service](https://us.ovhcloud.com/identity-security-operations/logs-data-platform/)   ## Instructions ### How is IAM useful for Logs Data Platform? Enabling OVHcloud IAM on Logs Data Platform delegates authentication, access management, and permissions to OVHcloud IAM. There are several benefits to using IAM: - [All OVHcloud identities](https://docs.us.ovhcloud.com/en/manage-and-operate/iam/presentation-identity-interactions-within-ovhcloud-account.md) can connect using their credentials to all Web UIs (i.e., Graylog, OpenSearch Dashboards). The connected account will be the identity chosen for UI access. **You will no longer need the Logs Data Platform username**. IAM also enables the use of [two-factor authentication methods](https://docs.us.ovhcloud.com/en/account/account-information/secure-account-two-factor-authentication.md) and [Federation Services](https://docs.us.ovhcloud.com/en/account/account-information/sso-active-directory-federation-services.md). - API tokens can be both [service account tokens](https://docs.us.ovhcloud.com/en/manage-and-operate/api/managing-ovhcloud-service-accounts.md) and Personal Access Tokens handled directly with OVHcloud IAM APIs. - [Resource groups](https://docs.us.ovhcloud.com/en/manage-and-operate/iam/using-policies-ovhcloud-api.md) allow you to share Logs Data Platform sub-resources more cohesively. - [IAM Policies](https://docs.us.ovhcloud.com/en/manage-and-operate/iam/using-policies-ovhcloud-api.md) unlock advanced use cases that are not possible with permissions, thanks to fine-grained actions.   ### How to enable OVHcloud IAM for my existing account in Logs Data Platform? If you have an existing service, follow these steps: - Replace all your **Roles** and permissions with [appropriate policies](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/iam-access-management.md). - Ensure you have no **Roles** declared in your service. - Ensure your service is not in any **Roles**. - Ensure you don't have any [tokens](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/secure-apis-with-tokens.md). - Use the `Enable OVHcloud IAM` button in the `Roles` tab of the Logs Data Platform Control Panel. Once IAM is activated, a new `IAM Policies` tab will replace the previous `Roles` tab.   ### How to enable OVHcloud IAM on a new service? When a new service is created, you can directly opt into using IAM and use [IAM policies](https://docs.us.ovhcloud.com/en/account/account-information/use-iam-policies-console.md) to handle access rights. Once IAM has been activated, you can freely use any [OVHcloud identities](https://docs.us.ovhcloud.com/en/manage-and-operate/iam/presentation-identity-interactions-within-ovhcloud-account.md) to interact with Logs Data Platform.   ### How to connect to Graylog with IAM? When connecting to Graylog, you can choose between the legacy username/password system (for services without IAM activated) or the OVHcloud IAM US provider. Clicking the `Log in with OVHcloud IAM US` button redirects you to complete authentication. **Warning:** **NOTE:** Only the US provider is supported.   ### How to connect to OpenSearch Dashboards with IAM? When connecting to OpenSearch Dashboards, select the provider linked to your OVHcloud service. The `Log in with single sign-on` button redirects you to your provider to complete authentication. Once completed, you will be redirected back to the OpenSearch Dashboard instance fully authenticated.   ### How to interact with Logs Data Platform backends API? With IAM enabled, [tokens](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/secure-apis-with-tokens.md) are replaced by API keys (Bearer authentication scheme). These keys can be tokens from [service accounts](https://docs.us.ovhcloud.com/en/manage-and-operate/api/managing-ovhcloud-service-accounts.md) or Personal Access Tokens. Use the OVHcloud API to generate these tokens. [POST /me/identity/user/{user}/token](https://api.us.ovhcloud.com/console/?section=/me&branch=v1#post-/me/identity/user/-user-/token) For example, if you are on bhs2 cluster, curl can use these tokens in the following way: ```bash ldp@laptop curl -k -v -H 'content-type: application/json' --oauth2-bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c -XGET 'https://bhs2.logs.ovh.com:9200/_cluster/health?pretty' ```   ### How to create indices or aliases on Logs Data Platform backend APIs? First, ensure the identity you want to use has permission to create indices and aliases for the service. If authorized, Personal Access Tokens or service account OAuth2 clients can perform creation/deletion operations. **Warning:** **NOTE:** The previous prefix for indices and aliases was the username. Now the prefix is the **service name**. You will find the service name on the homepage of the Logs Data Platform control panel. It is also the suffix of a Logs Data Platform service URN. For example: `urn:v1:us:resource:ldp:ldp-ab-56945` The service is tied to a unique Logs Data Platform, so you will be allowed to create items only on this cluster. For example if ldp-ab-56945 is on bhs2: ```bash ldp@laptop curl -k -v -H 'content-type: application/json' --oauth2-bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c -XPOST 'https://bhs2.logs.ovh.com:9200/ldp-ab-56945-i-my-new-index/_doc' -d '{ "user" : "ldp" }' ``` Similarly, aliases created through OpenSearch APIs must be prefixed by one of your allowed services.   ## Go further Browse all the [Logs Data Platform guides](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/landing-page-logs-data-platform.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Logs Data Platform](https://us.ovhcloud.com/identity-security-operations/logs-data-platform/) on the OVHcloud US website. - [Introduction to Logs Data Platform](https://docs.us.ovhcloud.com/en/manage-and-operate/logs-data-platform/introduction-to-logs-data-platform.md) - IAM for Logs Data Platform - Our documentation - Create an account: [Try it!](https://us.ovhcloud.com/identity-security-operations/logs-data-platform/)