Identity Access Management (IAM)

Overview

The Impossible Cloud Storage Console (ICSC) is an enterprise-grade cloud storage management tool that offers Identity and Access Management (IAM). This feature enables Role-Based Access Management (RBAC) for securing your storage and complying to data governance rules and regulatory requirements.

The Impossible Cloud Storage is S3 compatible and is built based on the industry-standard. Thus, users can expect the underlying IAM features to be similar to what they are accustomed to. The Impossible Cloud Storage's IAM features can be configured through the Storage Console (GUI) as well as using the .

Users, Policies, and Groups

There are three main concepts that should be considered when using Impossible Cloud Storage's IAM features: Users, Policies, and Groups - each with a dedicated tab in the GUI.

: A specific account with a dedicated login mail and password. This can either be a root user or a sub-user. A user represents an individual that can access the Impossible Cloud Storage Console. For instance, an employee in a marketing department.

Currently, every organization will receive one root user with the ability to manage identity and access for their organization.

: A set of permissions defining what individuals can see and do. These rules are defined on a group level, which consists of dedicated users. For instance, this could comprise of permissions for the marketing department to access marketing-relevant content.
: A representation of an organizational unit comprising of user accounts assigned to selected policies. For instance, this could be a marketing department.

Supported IAM Features

To provide true S3 compatibility, our object storage supports all S3 actions and effects. This means that permissions can be assigned at the most granular level. For instance:

List: Shows a list of buckets authorized for the respective group. This is a minimum requirement for any sub-user in that group to see the assigned buckets.
Read: This allows the assigned group's sub-users to retrieve objects with their previous versions and configurations (e.g. object lock status, retention periods, and legal hold status).
Write: This allows sub-users of the assigned group to delete and/or add an object to a bucket.

PreviousSecuring Your Data NextManaging Users

Last updated 4 days ago

Was this helpful?

Overview

Users, Policies, and Groups

There are three main concepts that should be considered when using Impossible Cloud Storage's IAM features: Users, Policies, and Groups - each with a dedicated tab in the GUI.

: A specific account with a dedicated login mail and password. This can either be a root user or a sub-user. A user represents an individual that can access the Impossible Cloud Storage Console. For instance, an employee in a marketing department.

Currently, every organization will receive one root user with the ability to manage identity and access for their organization.

: A set of permissions defining what individuals can see and do. These rules are defined on a group level, which consists of dedicated users. For instance, this could comprise of permissions for the marketing department to access marketing-relevant content.

: A representation of an organizational unit comprising of user accounts assigned to selected policies. For instance, this could be a marketing department.

Supported IAM Features

To provide true S3 compatibility, our object storage supports all S3 actions and effects. This means that permissions can be assigned at the most granular level. For instance:

List: Shows a list of buckets authorized for the respective group. This is a minimum requirement for any sub-user in that group to see the assigned buckets.

Read: This allows the assigned group's sub-users to retrieve objects with their previous versions and configurations (e.g. object lock status, retention periods, and legal hold status).

Write: This allows sub-users of the assigned group to delete and/or add an object to a bucket.

Refer to AWS documentation on S3 and for more details.