Services

IamService

plany.iam.v1.IamService — who can do what: roles, API keys and service accounts.

Endpoint api.plany.cloud:443 · Guide · Reference

IAM decides who can do what on your account and its projects. You give a person or a service account a role on an account or a project, and the role carries the permissions. API keys are created here too.

Roles and policies

A policy is the list of role bindings on one account or project. Read it, change it, and write it back:

Call	What it does
`ListRoles`	Every role you can grant, with the permissions each holds.
`GetIamPolicy`	The bindings on `accounts/{account}` or `projects/{project}`.
`SetIamPolicy`	Replaces them. Send the `etag` you read, and a concurrent change is refused with `ABORTED` rather than lost.
`CheckPermissions`	Whether you hold some permissions on a resource — "could I do this here?"

1resource "plany_project_iam_member" "deployer" {
2  project = ""
3  role    = "roles/project.editor"
4  member  = plany_service_account.deployer.name
5}

SetIamPolicy replaces the whole policy. Always read it first, change the bindings you mean to, and send the rest back unchanged — otherwise you remove everybody you left out.

A role granted on an account applies to every project in it; a role granted on a project applies to that project only.

Service accounts

accounts/{account}/serviceAccounts/{service_account}

A service account is an identity for software rather than a person: a CI job, a backend, a game server reading a secret. Create one with CreateServiceAccount, grant it roles like anyone else, and either create an API key for it or attach it to a workload.

1resource "plany_service_account" "deployer" {
2  service_account_id = "deployer"
3  display_name       = "CI deployer"
4}

Attaching a service account to a workload needs iam.serviceAccounts.actAs on that service account, so nobody can borrow an identity with more access than their own.

API keys

accounts/{account}/apiKeys/{api_key}

Call	What it does
`CreateApiKey`	Creates a key. The key itself is returned once, in `key_string`. Set `subject` to a service account to make the key act as it.
`ListApiKeys`, `GetApiKey`	Your keys, with their prefix, state and last use — never the key itself.
`RotateApiKey`	A new key; the old one keeps working for a grace period so you can redeploy.
`DeleteApiKey`	Stops a key working immediately.

See Authentication for using one.

Signing in

IssueToken is how the console and plany auth login sign a person in, and ChangePassword changes your password. Your own programs should use an API key instead.