This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

IAM

1: Overview

2: How-to Guides

2.1: User Group
2.2: User
2.3: Policy
2.4: Role
2.5: Credential Providers
2.6: My Info.
2.7: JSON Writing Guide

3: API Reference

4: CLI Reference

5: Release Note

1 - Overview

Service Overview

IAM(Identity and Access Management) is a service that controls the range of access to services and resources by verifying the identity of users registered on the Samsung Cloud Platform and granting access permissions. Administrators can create and manage users, permission groups, policies, and role items in detail through IAM.

Users can create new users if they are the Root user or have been granted user registration authority by the Root user. Policies cannot be assigned directly to users; instead, users are added to user groups, and policies are attached to those groups, granting specific users permission to access or manage resources. In other words, the tasks a user can perform within an account depend on which user group they belong to and which policies are attached to that group.

Provided features

IAM provides the following features.

User Authentication: Provides multi-factor authentication (MFA; Multi-Factor Authentication) for Console and API access. Additionally, it blocks unauthorized access by allowing access only from permitted IP ranges.
Permission Management: Add users to user groups based on tasks, limiting their access permissions to the parts required for the work. Administrators can manage and assign custom policies.
Role Management: You can switch from your own account to another role to access the Account.
Credential Provider Offering: You can access and use the Account within the Console via the credential provider.
Access Control Policy Management: Create access control policies for each service regarding control/action/resource type and authentication method/IP. This enables the application of least‑privilege policies when granting access to cloud resources, allowing user‑based access control.

Component

Users can create and manage user groups, users, policies through Identity and Access Management(IAM).

User group

In the user group, you can register users and add policies. You can create user groups tailored to each task, register users, and attach appropriate policies to grant the same permissions to users and manage them.

User

Administrators can create users and add them to user groups. They can generate a user’s password automatically or manually, and provide the user with account-specific login information.

User Policy

You can create policies for the functions provided by each service. Access control can be managed based on control type, applied resources, and authentication type.

role

It is a virtual user account with separate permissions, not affected by the permissions of the original user account.

Preceding Service

Identity and Access Management(IAM) has no prerequisite service.

2 - How-to Guides

Users can create and manage User Groups, Users, Policies, My Info. through Identity and Access Management(IAM).

Getting Started with IAM

Click the All Services > Management > IAM menu. Go to the Service Home page of IAM.

On the Service Home page, My Info., Account information, Quick Link, and IAM status are provided as widgets.

Category	Detailed description
My Info.	User name, email, and user group information accessed in the Samsung Cloud Platform Console. Click the More button to go to the My Info page.
Account information	Provides the user’s Account ID, Account alias, and IAM user login URL if the user is an IAM user Account ID: User’s Account ID Account alias: A name assigned to the Account. It allows you to attach an alias for easier identification and management of the Account Edit: If you edit the Account alias, the IAM user login URL that uses the current alias will no longer be usable. See Edit Account Alias Delete: If you delete the Account alias, IAM users will no longer be able to log in using the Account alias. See Delete Account Alias IAM user login URL can be used to log in without entering Account information For more details related to the Account, see Account see
Quick Link	Description of My Info. and My Info. button navigates to the page. For more details about My Info., see My Info.
IAM status	Counts of user groups, users, and policies

Table. IAM Service Home widget items

Modify Account Alias

You can edit the Account alias in the Service Home > Account widget of IAM.

Click the All Services > Management > IAM menu. Go to the Service Home page of IAM.
On the Service Home page, in the Account widget, click the Edit button of the Account alias. You will be taken to the Edit Account Alias popup.
Edit Account Alias After reviewing the instructions in the popup window, edit the Account alias and click the Confirm button.
Reference
When modifying an Account alias, the Console login URL that uses the current alias will no longer be usable.
After making changes, if the alias is not used by another account, you can reuse the alias you were previously using.

Delete Account Alias

You can delete an Account alias from the IAM Service Home > Account widget.

Click the All Services > Management > IAM menu. Navigate to the Service Home page of IAM.
On the Service Home page, in the Account widget, click the Delete button of the Account alias. You will be taken to the Delete Account alias popup.
Account Alias Deletion After reviewing the instructions in the popup window, click the Confirm button.
Caution
If you delete the account alias, IAM users can no longer log in using the account alias.
- The IAM login URL is also unavailable.

2.1 - User Group

Users can create the service by entering the required information for a user group and selecting detailed options through the Samsung Cloud Platform Console.

Create user group

To create a user group, follow these steps.

All Services > Management > IAM menu, click it. 1. Navigate to the Service Home page of Identity and Access Management (IAM).
On the Service Home page, click the User Group menu. 2. Navigate to the User Group List page.

On the User Group List page, click the Create User Group button. 3. Navigate to the Create User Group page.

Enter the required information in the Basic Information Entry, Add User, Policy Connection, and Additional Information Entry areas.

Category	Required status	Detailed description
User group name	Required	Enter user group name using Korean, English, numbers, and special characters (`+=,.@-_`) as a value of 3 to 24 characters
Explanation	Select	Description of the user group name Detailed description of the user group name, up to 1,000 characters allowed
User	Select	User to add to the user group The list of users registered in the Account is displayed, and when a checkbox is selected, the selected user’s name appears at the top of the screen At the top of the screen, click the X button for each user, or uncheck the checkbox in the user list to cancel the selection of the selected user If there are no users to add, you can click User Creation at the bottom of the user list to first register a new user After user creation is complete, refresh the user list, and once the user appears, you can select the user For detailed information on creating a user group, see Create User for reference
policy	Select	Policy to attach to the user group The list of policies registered in the Account is displayed, and when a checkbox is selected, the name of the selected policy appears at the top of the screen At the top of the screen, you can click the X button for each policy, or deselect the checkbox in the policy list to cancel the selection of a policy If there is no policy to attach, you can click Create Policy at the bottom of the policy list to first register a new policy After creating the policy, refresh the policy list; once the policy appears, you can select it For detailed information on creating policies, see Create Policy for reference
tag	Select	Tags to add to the user group can be added up to a maximum of 50 per resource

Table. User group creation information input fields

Create button, click it.
When the popup indicating creation opens, click the Confirm button. 5. Navigate to the User Group List page.

Check user group detailed information

In the user groups, you can view and edit the list of user groups and their detailed information. The User Group Detail page consists of Basic Information, Users, Policies, Tags tabs.

To view detailed information of the user group service, follow these steps.

All Services > Management > IAM Click the menu. 1. Go to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Go to the User Group List page.
User Group List page, click the user group name to view its details. 3. Go to the User Group Details page.
- User Group Detail page displays basic information, and consists of Basic Information, Users, Policies, Tags tabs.

Basic Information

User Group List page allows you to view the basic information of the selected user group and, if necessary, edit the user group name and description.

Category	Detailed description
service	Service Name
Resource Type	Resource Type
SRN	Unique resource ID in Samsung Cloud Platform
Resource name	Resource name In a user group, it refers to the user group name
Resource ID	Unique Resource ID
Constructor	User who created the service
Creation date and time	Service creation date and time
Modifier	User who edited the service information
Modification date and time	Date and time the service information was modified
User group name	Name of the user group
Explanation	Description of the user group name

Table. User group basic information tab items

User

User Group List page lets you view the users included in the selected user group and, if needed, add or delete users.

Reference

For detailed information about User, please refer to User.

Category	Detailed description
Exclude	Exclude users from the user group Activate when selecting a user from the user list Refer to Exclude user for details
Add user	Add another user to the user group When the button is clicked, navigate to the Add User page For more details, see Add User
Username	User’s name
User group	Number of user groups the user belongs to When the item is clicked, you can view the associated user group name and navigate to its detail page
Creation date and time	User creation timestamp

Table. User Group Details – User Tab Items

Policy

User Group List page allows you to view the policy attachment information of the selected user group, and, if necessary, modify the policy attachment information for the user group.

Reference

For detailed information about Policy, refer to Policy.

Category	Detailed description
Disconnect	Disconnect the selected policy Activates when a policy is selected from the policy list For more details, see Detach policy
Policy connection	Connect a new policy to the user group When the button is clicked, navigate to the Policy Connection page Refer to Connect Policy for more details
Policy name	Policy name
Policy Type	Type of attached policy Default: Default policy provided by Samsung Cloud Platform Custom: Policy created directly by the user
Explanation	Explanation of the policy
Creation date and time	Policy creation timestamp
Modification date and time	Policy modification date and time

Table. User Group Details – Policy Tab Items

Category	Detailed description
Tag list	Tag list You can view the Key and Value information of the tag Up to 50 tags can be added per resource When entering a tag, you can search and select from the list of previously created Keys and Values

Manage user groups

You can rename a user group, add users, attach policies, or modify tags. If you need to manage user groups, you can perform tasks on the User Group List or User Group Details page.

Edit Basic Information

You can edit the name and description of a user group. To modify the name and description of a user group, follow the steps below.

Click the All Services > Management > IAM menu. 1. Navigate to the Service Home page of Identity and Access Management (IAM).
On the Service Home page, click the User Group menu. 2. Go to the User Group List page.
On the User Group List page, click the user group name whose basic information you want to edit. 3. Navigate to the User Group Details page.
After confirming the basic information to be edited on the User Group Details page, click the Edit button.
- User Group Name: You can change the user group name. * Edit button click opens the Edit User Group Name popup.
- Description: You can edit the description of a user group. * Edit button click opens the Edit Description popup window.
After editing the content to be changed in the popup window, click the Confirm button.

Manage Users

You can add or remove users from a user group.

Add User

To add a user to a user group, follow the steps below.

Click the All Services > Management > IAM menu. 1. Go to the Service Home page of Identity and Access Management (IAM).
On the Service Home page, click the User Group menu. 2. Go to the User Group List page.
User Group List page, click the user group name to which you want to add a user. 3. Navigate to the User Group Details page.
On the User Group Details page, click the User tab. 4. Go to the User tab.
In the User tab, click the Add User button. 5. Go to the Add User page.

On the Add User page, select the user you want to add from the User list, then click the Complete button. 6. A popup window notifying the addition of a user opens.

Category	Detailed description
Added user	Display users included in the user group
User	Select users to add to the user group from the list of users registered in the Account When the checkbox is selected, the name of the selected user group is displayed at the top of the list You can remove the added user by clicking the X button next to the user’s name at the top of the list, or by unchecking the checkbox in the user list If the desired user is not present, you can click the Create User item at the bottom of the user list to register a new user first After creating the user, refresh the user list and then you can select the newly created user For detailed information on creating users, see Create User

Exclude user

To exclude a user from a user group, follow these steps.

Click the All Services > Management > IAM menu. 1. Navigate to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Navigate to the User Group List page.
User Group List page, click the user group name to exclude the user. 3. Navigate to the User Group Details page.
On the User Group Details page, click the User tab. 4. Go to the User tab.
In the User tab, select the user to exclude from the displayed user list, then click the Exclude User button.
The selected user is excluded and the user list is refreshed.

Manage Policies

You can attach a policy to a user group or detach an attached policy.

Connect Policy

To attach a policy to a user group, follow these steps.

Click the All Services > Management > IAM menu. 1. Go to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Navigate to the User Group List page.
User Group List page, click the user group name to which you want to attach the policy. 3. Navigate to the User Group Details page.
On the User Group Details page, click the Policy tab. 4. Go to the Policy tab.
In the Policy tab, click the Attach Policy button. 5. Navigate to the Policy Attachment page.

After selecting the policy to attach to the user group, click the Complete button. 6. A popup window notifying the policy connection opens.

Category	Detailed description
Linked policy	Display policies directly attached to the user group
policy	Select a policy to attach to the user group from the list of policies registered in the Account When you select the checkbox, the selected policy name is displayed at the top of the list You can cancel the policy by clicking the X button of the added policy name at the top of the list, or by unchecking the checkbox in the policy list If there is no policy to attach, you can first create a new policy by clicking the Create Policy item at the bottom of the policy list After creating the policy, refresh the policy list and you can select the newly created policy For detailed information on creating policies, see Create Policy reference

Disconnect policy

To detach the policies linked to a user group, follow these steps.

All Services > Management > IAM Click the menu. 1. Navigate to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Go to the User Group List page.
On the User Group List page, click the user group name to detach its policy connection. 3. Navigate to the User Group Details page.
On the User Group Details page, click the Policy tab. 4. Go to the Policy tab.
In the Policy tab, select the policy to disconnect from the displayed policy list, then click the Disconnect button.
The selected policy is disconnected and the policy list is refreshed.

Manage Tags

You can edit the tags of a user group. To modify tags in a user group, follow these steps.

All Services > Management > IAM Click the menu. 1. Navigate to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Go to the User Group List page.
Click the user group name whose tag information you want to edit on the User Group List page. 3. Go to the User Group Details page.
On the User Group Detail page, click the Tag tab. 4. Navigate to the Tag tab.
In the Tag tab, click the Edit Tag button.
After adding or editing tags, click the Save button. 6. A popup window notifying tag editing opens.
- You can modify the Key and Value of an already registered tag.
- You can click the Add Tag button to add a new tag.
- Click the X button before the added tag to delete that tag.
Click the Confirm button. 7. You can view the edited tag information in the list.

Delete user group

To delete a user group, follow the steps below.

All Services > Management > IAM Click the menu. 1. Navigate to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Navigate to the User Group List page.
User Group List page, click the user group name you want to delete. 3. Navigate to the User Group Details page.
On the User Group Details page, click the Delete User Group button.
The user group is deleted, and you are redirected to the User Group List page.

To delete multiple user groups simultaneously, follow these steps.

All Services > Management > IAM Click the menu. 1. Navigate to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User Group menu. 2. Go to the User Group List page.
Check the user groups to delete from the user group list.
Check the selected user groups, and click the Delete button.
The selected user groups are deleted and the User Group List page is refreshed.

2.2 - User

Users can create the service by entering the required policy information and selecting detailed options through the Samsung Cloud Platform Console.

Create User

Follow the steps below to create a user.

Click the All Services > Management > IAM menu. 1. Go to the Service Home page of Identity and Access Management (IAM).
Service Home on the page, click the User menu. 2. Navigate to the User List page.
On the User List page, click the Create User button. 3. Go to the User Creation page.

On the User Creation page, after entering the required information in the Basic Information Input, Permission Settings, and Additional Information Input sections, click the Create button. 4. A popup window announcing user creation opens.

Category	Required	Detailed description
Username	Required	Using the user’s name English letters, numbers, and special characters (`+=,.@-_`), enter a value within 64 characters
Explanation	Selection	Description of the username Enter a detailed description of the username, up to 1,000 characters
Password	Required	There are two ways to generate a password for user use. Automatic generation: The password is generated automatically and can be viewed at the time of user creation Direct input: The password is created manually
Password change settings	Selection	Password change setting at first user login If not set, the user cannot change the password at first login, but can reset it via Password Reset For details on password reset, see 비밀번호 수정하기 for reference
Permission configuration method	Required	Add to User Group: Select a user group from the list of user groups registered in the Account to include the user

- Click the **X** button next to the added user group name at the top of the list, or uncheck the checkbox in the user group list to cancel that user group
If there is no user group to connect, you can click the **Create User Group** item at the bottom of the user group list to register a new user group first

After creating a user group, refresh the user group list and then you can select the newly created user group

- **Copy Permissions**: Select a user to copy the policies attached to that user's user groups
- **Select User**: Choose one user from the list to copy policies
  - **Permission Summary**: Displays the list of policies directly attached to the selected user or attached via user groups

Tags can be added up to a maximum of 50 per resource

Table. User-generated information input items

Password creation rules

If you enter the password incorrectly five or more times, you will be automatically logged out.
It must contain at least one each of uppercase letters (English), lowercase letters (English), digits, and special characters (! @ # $ % & * ^).
The length is 9 to 20 characters.
You cannot use the ID as a password.
You cannot use the same character more than three times.
Passwords that are easy to guess cannot be used.
Consecutive characters or numbers of four or more characters are not allowed.
The password change cycle is 90 days.

In the popup that notifies user creation, click the Create button. 5. IAM user login information The popup window opens.

After checking the IAM user login information, click the Confirm button. 6. Navigate to the User List page.

Category	Detailed description
Account ID	Account ID value
username	Generated user name
Password	Generated user’s password View icon can be clicked to check the password
IAM user login URL	IAM user’s login URL information
Excel download	Download IAM user login information as an Excel file
Email sending	Send an Excel file containing IAM user login information via email After clicking the button, enter the address to receive the email

Table. IAM user login information items

Check user detailed information

In the user section, you can view and edit the user list and detailed information. User Details page consists of Basic Information, User Groups, Permissions, API Keys, Tags tabs.

To view detailed information of the user service, follow the steps below.

All Services > Management > IAM menu, click it. 1. Go to the Service Home page of Identity and Access Management (IAM).
On the Service Home page, click the User menu. 2. User List page is opened.
On the User List page, click the user name to view detailed information. 3. Navigate to the User Details page.
- User Details page displays basic information and consists of Basic Information, Users, Permissions, API Keys, Tags tabs.

Reference

In the user list, clicking the authentication key count allows you to view the authentication key information and its current status (active, disabled).

Basic Information

User List page allows you to view the basic information of the selected user and, if needed, modify the user’s description and options.

Category	Detailed description
Service	Service name
Resource Type	Resource Type
SRN	Unique resource ID in Samsung Cloud Platform
Resource name	resource name In the user context, it means the username
Resource ID	Unique Resource ID
Constructor	User who created the service
Creation date and time	Service creation date and time
Modifier	User who edited the service information
Modification date and time	Date and time the service information was modified
username	User’s name
Last login	The date and time the user last logged in
Explanation	Description of the username
Password	The date and time the password was last changed Refer to 비밀번호 수정하기 for details
Password reuse restriction	Prevent reuse of recently used passwords Edit icon can be clicked to change the number of password histories to restrict For more details, see 비밀번호 재사용 제한하기
email	Email verification status
mobile phone number	Mobile phone number verification status

Table. User Details - Basic Information Tab Items

User group

User List page lets you check the user groups registered to the selected user, and, if necessary, add or remove user groups.

Reference

For detailed information about User Group, see the 사용자 그룹.

Category	Detailed description
Exclude	Exclude the user from the user group Enabled when selecting a user group from the user group list For more details, see 사용자 그룹 제외하기
Add user group	Add the user to another user group When the button is clicked, navigate to the Add User Group page For more details, see Add User Group
User group name	Name of the user group
Linked policy	Number of policies linked to the user group When the item is clicked, you can view the linked policy name and navigate to the corresponding policy details page
Explanation	Description of the user group
Modification date and time	Date and time the user group was modified

Table. User Details - User Group Tab Items

Permission

User List page allows you to view the selected user’s policy information, and you can add, modify, or delete it.

Category	Detailed description
Disconnect	Disconnect the selected policy Activate when a policy is selected from the policy list Refer to 권한 해제하기 for more details
More	Direct connection can be removed or excluded from user groups Direct connection removal: When the connection method is direct, remove the direct connection of the policy Exclude from user group: Exclude a user from the user group
Add permission	Connect the new policy to the user When the button is clicked, navigate to the Add Permission page For more details, see 권한 추가하기
Policy Name	Policy name Click the policy name to view the policy detail page
type	Policy types
Explanation	Explanation of the policy
Connection method	Policy connection method Direct: User connects directly to the policy Group: Connect to the policy through a group Direct, Group: Both direct connection and group connection are applied When selecting a group name, navigate to the group’s detail page
Modification date and time	Last policy modification date and time

Table. User Details – Permissions Tab Items

Authentication key

User List page allows you to view the authentication key information of the selected user.

Category	Detailed description
Access Key	Authentication key information
Secret Vault	Whether to use encryption
Creation timestamp	Authentication key creation time
Expiration date and time	Authentication key expiration time
status	Authentication key usage (use/disable)

Table. User Details - Authentication Key Tab Items

Category	Detailed description
Tag List	Tag list You can view the Key and Value information of the tag Up to 50 tags can be added per resource When entering a tag, you can search and select from the list of previously created Keys and Values

Manage Users

You can change a user’s basic information, add user groups, or edit tags. If user management is required, you can perform tasks on the User List or User Details page.

Edit basic information

You can edit the user’s basic information.

Caution

Usernames cannot be edited.

Edit description

Follow these steps to edit the user’s description.

Click the All Services > Management > IAM menu. 1. Go to the Service Home page of Identity and Access Management (IAM).
Click the User menu on the Service Home page. 2. User List page is opened.
On the User List page, click the user name whose description you want to edit. 3. User Details page will be opened.
User Details page, view the description and click the Edit button. 4. Edit description The popup window opens.
Edit Description After modifying the description in the popup window, click the Confirm button.

Change Password

To change a user’s password, follow these steps.

All Services > Management > IAM menu, click it. 1. Go to the Service Home page of Identity and Access Management(IAM).
On the Service Home page, click the User menu. 2. User List page.
On the User List page, click the username whose password you want to edit. 3. Navigate to the User Details page.
On the User Details page, click the Edit password button. 4. Password Reset The popup window opens.
After changing the password, click the Confirm button. 5. IAM user login information The popup window opens.
- Password has the following two settings.
  - Automatic Generation: A random password is generated.
  - Manual entry: It is generated with a password entered directly by the user. * It must contain at least one each of uppercase letters (English), lowercase letters (English), digits, and special characters (! @ # $ % & * ^). * Please refer to the password creation rules.
- Password Change Setting: It is recommended to change the password upon first login after resetting the password.

Password creation rules

It must contain at least one uppercase letter (English), one lowercase letter (English), one digit, and one special character (! @ # $ % & * ^).
The length is 9 to 20 characters.
You cannot use the ID as a password.
You cannot use the same character more than three times.
You cannot use passwords that are easy to guess.
You cannot use a password that was recently used.
Consecutive characters or numbers of four or more characters are not allowed.
The password change interval is 90 days.

After checking the user-generated information, click the Confirm button. 6. Password change has been completed.

Category	Detailed description
Account ID	Account ID value
username	Generated user name
Password	Generated user’s password View icon can be clicked to check the password
IAM user login URL	IAM user’s login URL information
Excel download	Download IAM user login information as an Excel file
Email sending	Send an Excel file containing IAM user login information via email After clicking the button, enter the address to receive the email

Table. IAM user login information items

Restrict password reuse

Specify the number of password history entries to check so that recently used passwords cannot be reused. To restrict users from reusing passwords, follow the steps below.

All Services > Management > IAM Click the menu. 1. Go to the Service Home page of Identity and Access Management (IAM).
Click the User menu on the Service Home page. 2. Navigate to the User List page.
User List page, click the username to modify the password reuse restriction. 3. Navigate to the User Details page.
On the User Details page, click the Edit button for the secret password reuse restriction. 4. Password reuse restriction edit The popup window opens.
- Password reuse restriction: Select the number of recent password history entries as a number between 1 and 24.
Click the Confirm button. 5. Password reuse restriction count has been changed.

User Group Management

You can add a user to a user group or remove a user from a user group.

Add user group

To add a user to a user group, follow the steps below.

All Services > Management > IAM click the menu. 1. Go to the Service Home page of Identity and Access Management (IAM).
Click the User menu on the Service Home page. 2. Go to the User List page.
On the User List page, click the user name to add to the user group. 3. Navigate to the User Details page.
On the User Details page, click the User Group tab. 4. Go to the User Group tab.
In the User Group tab, click the Add User Group button. 5. Navigate to the Add User Group page.

On the Add User Group page, select the user group you want to add from the User Group list, then click the Done button. 6. A popup window announcing the addition of a user group opens.

Category	Detailed description
Added user group	Display user groups that contain the user
Add to user group	Select the user group to which you want to add a user from the list of user groups registered in the Account When you select the checkbox, the name of the selected user group is displayed at the top of the list You can remove the user group by clicking the X button next to the added user group name at the top of the list, or by unchecking the checkbox in the user group list If the desired user group is not present, you can click the Create User Group item at the bottom of the user group list to register a new user group first After creating the user group, refresh the user group list and then you can select the newly created user group For detailed information on creating user groups, see 사용자 그룹 생성하기

Exclude user group

To remove a user from a user group, follow these steps.

Click the All Services > Management > IAM menu. 1. Go to the Service Home page of Identity and Access Management(IAM).
Click the User menu on the Service Home page. 2. Navigate to the User List page.
On the User List page, click the username to exclude from the user group. 3. Navigate to the User Details page.
On the User Details page, click the User Group tab. 4. Navigate to the User Group tab.
In the User Group tab, select the user group to exclude from the displayed list of user groups, then click the Exclude User Group button.
The selected user group is excluded and the user group list is refreshed.

Manage Permissions

You can attach a policy or detach an attached policy to configure user permissions.

Add Permission

You can include users in a user group to attach a policy, or attach a policy directly to the user.

To add permissions to a user, follow the steps below.

All Services > Management > IAM Click the menu. 1. Go to the Service Home page of Identity and Access Management (IAM).
On the Service Home page, click the User menu. 2. Navigate to the User List page.
On the User List page, click the username to which you want to add permissions. 3. Navigate to the User Details page.
On the User Details page, click the Permissions tab. 4. Go to the Permissions tab.
Click the Add Permission button on the Permission tab. 5. Go to the Add Permission page.
After selecting the method to add permissions, enter the required information.
Category
Required status
Detailed description
Permission addition method Required
Add to user group: Select a user group from the list of user groups registered in the Account to include the user

Category	Required status	Detailed description
Permission addition method	Required	Add to user group: Select a user group from the list of user groups registered in the Account to include the user

- You can cancel the user group by clicking the **X** button of the added user group name at the top of the list, or by unchecking the checkbox in the user group list
If there is no user group to connect, you can first register a new user group by clicking the **Create User Group** item at the bottom of the user group list

After creating the user group, refresh the user group list and you can select the newly created user group

- **Copy permissions**: Select a user to copy the policies attached to that user's user groups
- **User selection**: Choose one user from the list to copy policies
- **Permission summary**: Displays the list of policies directly attached to the selected user or attached via user groups in the user selection list
**Direct policy attachment**: Select a policy from the list of policies registered in the Account to attach directly to the user

Table. Permission addition detailed items

Category	Required status	Detailed description
Control Type	Required	Select policy control type Allow Policy: A policy that permits the defined permissions Deny Policy: A policy that denies the defined permissions For the same target, the deny policy takes precedence
Action	Required	Select actions provided per service Actions that can select individual resources are shown in purple Actions that target all resources are shown in black Add Action Directly: Use the wildcard `*` to specify multiple actions at once
Applied resource	Required	Resources to which the action applies All resources: Apply the selected action to all resources Individual resource: Apply the selected action only to the specified resources Individual resources are only available when selecting a purple action that allows individual resource selection Click the Add resource button to specify target resources by resource type For more information about Add resource, see Register individual resources as applied resources
Authentication Type	Required	Authentication method of the user target to which the policy will be applied All authentication: Apply regardless of authentication method Authentication key authentication: Apply to users authenticated with an authentication key Temporary key authentication, Console login: Apply to users with temporary key authentication or Console login
Applied IP	Required	IP that allows policy application Custom IP: Users directly register and manage the IP Applied IP: IP to which the policy is applied, which users can register directly as an IP address or range Excluded IP: IP to be excluded from Applied IP, which can be registered as an IP address or range All IP: No IP access restriction Access is allowed for all IPs, but if exceptions are required, you can register Excluded IP to restrict access for those IPs
Additional condition	Selection	Add conditions for attribute-based access control (ABAC) Condition Key: Select from the list of Global condition keys and service condition keys Qualifier: Default value, arbitrary value in the request, all values in the request Operator: Bool, Null Value: True, False

Category	Detailed description
Edit permissions	Permission editing is possible Click the button to go to the Permission Edit page For detailed information on permission edit items, refer to Create Policy
View mode	Policy control type Basic mode: Displays policy items and detailed information in the default UI JSON mode: Displays in JSON editor mode
Control Type	Policy control type Allow policy: Policy that allows the defined permissions Deny policy: Policy that denies the defined permissions
Action	The functions provided by each service that are subject to the policy
Applied resource	Resources to which the action applies All resources: Apply to all resources for the selected action Individual resources: Apply only to the specified resources for the selected action
Authentication Type	Authentication method of the user target to which the policy will be applied All authentication: applies regardless of authentication method API key authentication: applies to users with API key authentication Temporary password authentication, Console login: applies to users with temporary password authentication or Console login
Applied IP	IP that permits policy application Custom IP: User registers and manages the IP directly Applied IP: User can directly register the IP address or range that the policy applies to Excluded IP: IP addresses or ranges that can be registered as exclusions from the Applied IP All IPs: No IP access restriction Access is allowed for all IPs, but if exceptions are needed, register Excluded IP to restrict access for those IPs

Provided features	explanation
Account ID	Account ID logged in to Samsung Cloud Platform Console
Role Name	Alias set when switching roles When an ID Center user accesses with a role, display as Permission Set Name Display session expiration time at the bottom
Time zone	User-set time zone Example: Asia/Seoul (GMT +09:00) Click Edit Time Zone to modify
Account	Account information For more details, refer to Account
Cost Management	You can view usage and billing details, payment history, and cost analysis, and manage Credit, budget, Account, and payment methods For more information, see Cost Management
Login user information	IAM user name after role assumption and the user’s Account ID
Switch to my account	Switch to the IAM user account and go to the Console Home page After switching roles, display
Role Switching	Can switch to another role For more details, see Switch Role
Logout	Log out from Samsung Cloud Platform Console

Category	Detailed description
Whether to use the authentication key	Display whether the authentication key is used You can configure it by clicking the Use, Disable button
Delete authentication key	Delete the authentication key
Authentication key	Access Key and Secret Key information Authentication key button, when clicked, opens a Password verification popup where you can enter the password and confirm
Usage	Purpose of the authentication key
Creation Date/Time	The date and time the user generated the authentication key
Expiration date and time	Expiration time of the authentication key generated by the user
Secret Vault	Whether to use the Secret Vault service When using the Secret Vault service, disabling and deleting the authentication key is not allowed

Category	Detailed description
Delete	Delete the selected key from the user key list Activate when a key is selected from the list
More	Select whether to use the user API key chosen from the user API key list Activate when selecting an API key from the list
Access Key	A unique string for calling the API
Secret Key	Security token used with the Access Key View button, when clicked, opens a Password Confirmation popup where you can enter the password and then confirm
Creation Date/Time	The date and time the user generated the authentication key
Expiration date and time	Expiration time of the authentication key generated by the user
status	Whether to use the authentication key

Category	Required	Detailed description
Policy Name	Required	Enter policy name using Korean, English, numbers, and special characters (`+=,.@-_`) as a value of 3 to 128 characters
Explanation	Select	Description of the policy name Enter a detailed description of the policy name, up to 1,000 characters
tag	Selection	Tags to add to the policy Tags can be added up to a maximum of 50 per resource

Category	Detailed description
Disconnect	Detach the selected policy from the role Enable when a policy is selected from the policy list
Policy connection	Connect a new policy to a role When the button is clicked, navigate to the Policy Connection page For more details about policy connection, see Policy Connection reference
Policy Name	Policy name Click the policy name to view the policy detail page
type	Types of policies
description	Explanation of the policy
Modification date and time	Date and time of the last policy modification

Category	required or not	Detailed description
Account ID	Required	Enter the Account ID the user wants to assume via role switching.
Role Name	Required	Enter the role name the user wants to switch to.
alias	Select	Name to use when a user enters through role switching
Color	Required	Select the color to use as the Account background when entering a role No selection: Apply the existing Account background color

Category	Whether required	Detailed description
Credential Provider Name	Required	Enter the credential provider name using English letters, numbers, and special characters (`,-_`) as a value within 128 characters
description	Selection	Enter a description of the credential provider within 1,000 characters
type	Required	Select the credential provider type SAML: Establish trust between the Samsung Cloud Platform account and a SAML 2.0‑compatible credential provider
metadata	Selection	Attach the metadata file provided by the IdP Attach File Click the button to upload only one file Only files up to 10 MB and UTF‑8 XML documents can be uploaded The metadata must include the issuer name, expiration information, and the key for verifying SAML authentication responses received from the IdP
tag	Select	Tags to add to the credential provider group Tags can be added up to a maximum of 50 per resource

Category	Detailed description
Username	User’s name
SRN	User’s SRN
email	User’s email
mobile phone number	User’s mobile phone number
Password	User’s password
Password reuse restriction	User password reuse limit count
Time zone	User’s time zone
Terms and Conditions	User’s name

Item	description	Required
Version	“Define the version of the policy language” Used with a different meaning than the policy version, and the current version is ““2024-07-01""	Required
Statement	Information on the key elements of the policy	Required
Statement.Sid	Policy element ID (unique ID for elements within the same policy)	Select
Statement.Effect	Policy application effect ( Allow : Allow / Deny : Deny )	Required
Statement.Principal	Security Principal	Required
Statement.Action	Policy target action (must specify either Action or NotAction)	Select
Statement.Resource	List of resources subject to policy evaluation	Required
Statement.Condition	Policy decision condition information	Selection

Item	Required or not	Case-sensitive	Explanation
operator	Required	O	Conditional operator when two or more operators are defined, it operates as AND For positive or negative operator types, see 조건 연산자(operator))
condition-key	Required	X	Policy condition key (global condition key, resource attribute condition key) when two or more condition-keys are defined, it operates as AND
condition-value	Required	Depends on the operator.	policy condition value
qualifier	Select	O	Qualifier, when there are two or more condition values extracted from the request context Definition method for operand and comparison condition

conditional operator	Operator type	Explanation
StringEquals	positive operator	Exact match, case-sensitive
StringNotEquals	negation operator	mismatch
StringEqualsIsIgnoreCase	positive operator	Exact match, case insensitive
StringNotEqualsIsIgnoreCase	negation operator	Mismatch, case-insensitive
StringLike	positive operator	Case-sensitive matching; multiple-character string matching (*) wildcard can be included in the value.
StringNotLike	negation operator	Case sensitivity mismatch, wildcard that matches multiple characters (*) can be included in values

conditional operator	Operator Types	description
NumericEquals	positive operator	Match
NumericNotEquals	negation operator	mismatch
NumericLessThan	positive operator	Match less than
NumericLessThanEquals	positive operator	as follows
NumericGreaterThan	positive operator	overmatch
NumericGreaterThanEquals	positive operator	Match above

conditional operator	Operator type	description
DateEquals	positive operator	Match specific date
DateNotEquals	negation operator	mismatch
DateLessThan	positive operator	Match before a specific date/time
DateLessThanEquals	positive operator	Match on a specific date/time or earlier
DateGreaterThan	positive operator	Match after a specific date/time
DateGreaterThanEquals	positive operator	Match on a specific date/time or later

conditional operator	Operator type	description
IpAddress	positive operator	specified IP address or range
NotIpAddress	negation operator	All IP addresses except the specified IP address or range

conditional operator	Operator Types	description
SrnEquals, SrnLike	positive operator	SRN match
SrnNotEquals, SrnNotLike	negation operator	SRN mismatch

condition key	Data type	singular/plural	description	example
scp:UserId	string	single	request user id	`“scp:UserId” : [“efda56a968cd45b2873d9bf5fab58e95”]`
scp:UserName	string	single	Request user name	`“scp:UserName” : [“foo”]`
scp:MultiFactorAuthPresent	bool	string	Request via MFA authentication	`“scp:MultiFactorAuthPresent” : [“True”]`
scp:RequestedRegion	string	single	request region	`“scp:RequestedRegion” : [“kr-west1”]`
scp:RequestAttribute/{AttributeKey}	string	single	request attribute value(AttributeKey) body query header	`“scp:RequestAttribute/body[‘foo’]” : [“true”]`
scp:TagKeys	string	single / multiple	request tag key	`“scp:TagKeys” : [“tag-key”]`
scp:RequestTag	string	single	Request tag key value	`“scp:RequestTag/tag-key” : [“tag-value”]`
scp:ResourceTag/{TagKey}	string	single	Resource tag key value	`“scp:ResourceTag/foo” : [“bab”]`
scp:SourceIp	ip_address	single	IP of the current requesting entity	`“scp:SourceIp” : [“1.1.1.1/24”]`
scp:CurrentTime	datetime	single	Request time (UTC, ISO 8601 format)	`“scp:CurrentTime” : [“2025-11-06T16:10:38Z”]`

IAM

1 - Overview

Service Overview

Provided features

Component

User group

User

User Policy

role

Preceding Service

2 - How-to Guides

Getting Started with IAM

Modify Account Alias

Delete Account Alias

2.1 - User Group

Create user group

Check user group detailed information

Basic Information

User

Policy

Tag

Manage user groups

Edit Basic Information

Manage Users

Add User

Exclude user

Manage Policies

Connect Policy

Disconnect policy

Manage Tags

Delete user group

2.2 - User

Create User

Check user detailed information

Basic Information

User group

Permission

Authentication key

tag

Manage Users

Edit basic information

Edit description

Change Password

Restrict password reuse

User Group Management

Add user group

Exclude user group

Manage Permissions

Add Permission

Revoke permission

Manage Tags

Delete User

2.3 - Policy

Create Policy

Load Policy

Register individual resources as applied resources

Check detailed policy information

Basic Information

Permission

Connection target

tag

Manage Policies

Edit Basic Information

Managing Permissions

Managing User Connections

Connect User

Disconnect User

Manage user group connections

Connect User Group

Disconnect User Group

Manage Role Bindings

Connect role

Unlink role

Tag Management

Delete Policy

2.4 - Role

Create Role

View role details

Basic Information

Executing entity