@flowcore/cli-plugin-iam
v1.8.1
Published
Flowcore CLI plugin for managing the IAM of the Flowcore Platform
Readme
Flowcore CLI Plugin - Iam
Flowcore CLI plugin for managing the IAM of the Flowcore Platform
Usage
$ npm install -g @flowcore/cli-plugin-iam
$ iam COMMAND
running command...
$ iam (--version)
@flowcore/cli-plugin-iam/1.8.1 linux-x64 node-v20.20.0
$ iam --help [COMMAND]
USAGE
$ iam COMMAND
...Commands
iam assign policy POLICY_NAMEiam assign role ROLE_NAMEiam create policy NAMEiam create role NAMEiam delete policy NAMEiam delete role NAMEiam edit policy NAMEiam edit role NAMEiam get key-policies KEY_IDiam get key-roles KEY_IDiam get policy [NAME]iam get role [NAME]iam get user-policies USER_IDiam get user-roles USER_IDiam unassign policy POLICY_NAMEiam unassign role ROLE_NAMEiam validate key KEY_IDiam validate user USER_ID
iam assign policy POLICY_NAME
Assign an IAM policy to a user, API key, or role. Exactly one of --user, --key, or --role must be specified
USAGE
$ iam assign policy POLICY_NAME -t <value> [--profile <value>] [-j] [--key <value> | --user <value> | --role
<value>]
ARGUMENTS
POLICY_NAME The name of the policy to assign
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) containing the policy
--key=<value> The API key ID to assign the policy to
--profile=<value> Specify the configuration profile to use
--role=<value> The role name to assign the policy to
--user=<value> The user ID to assign the policy to
DESCRIPTION
Assign an IAM policy to a user, API key, or role. Exactly one of --user, --key, or --role must be specified
EXAMPLES
$ flowcore iam assign policy read-access --user "auth0|abc123" -t my-org
$ flowcore iam assign policy read-access --key "550e8400-e29b-41d4-a716-446655440000" -t my-org
$ flowcore iam assign policy read-access --role data-reader -t my-org
$ flowcore iam assign policy read-access --user "auth0|abc123" -t my-org -jSee code: src/commands/assign/policy.ts
iam assign role ROLE_NAME
Assign an IAM role to a user or API key. Exactly one of --user or --key must be specified
USAGE
$ iam assign role ROLE_NAME -t <value> [--profile <value>] [-j] [--key <value> | --user <value>]
ARGUMENTS
ROLE_NAME The name of the role to assign
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) containing the role
--key=<value> The API key ID to assign the role to
--profile=<value> Specify the configuration profile to use
--user=<value> The user ID to assign the role to
DESCRIPTION
Assign an IAM role to a user or API key. Exactly one of --user or --key must be specified
EXAMPLES
$ flowcore iam assign role data-reader --user "auth0|abc123" -t my-org
$ flowcore iam assign role data-reader --key "550e8400-e29b-41d4-a716-446655440000" -t my-org
$ flowcore iam assign role data-reader --user "auth0|abc123" -t my-org -jSee code: src/commands/assign/role.ts
iam create policy NAME
Create a new IAM policy with the specified name, version, and policy documents defining resource access rules
USAGE
$ iam create policy NAME --documents <value> -t <value> --version <value> [--profile <value>] [--description
<value>] [-j]
ARGUMENTS
NAME The name of the policy to create
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) to create the policy in
--description=<value> A description of the policy
--documents=<value> (required) JSON array of policy documents, each with "resource" and "action" fields. Use
"-" to read from stdin
--profile=<value> Specify the configuration profile to use
--version=<value> (required) The version of the policy (e.g. 2024-01-01)
DESCRIPTION
Create a new IAM policy with the specified name, version, and policy documents defining resource access rules
EXAMPLES
$ flowcore iam create policy read-access -t my-org --version "2024-01-01" --documents '[{"resource":"frn::my-org:data-core/*","action":["read","fetch"]}]'
$ cat docs.json | flowcore iam create policy read-access -t my-org --version "2024-01-01" --documents -
$ flowcore iam create policy admin-access -t my-org --version "2024-01-01" --description "Full admin access" --documents '[{"resource":"frn::my-org:*","action":"*"}]' -jSee code: src/commands/create/policy.ts
iam create role NAME
Create a new IAM role with the specified name and optional description
USAGE
$ iam create role NAME -t <value> [--profile <value>] [--description <value>] [-j]
ARGUMENTS
NAME The name of the role to create
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) to create the role in
--description=<value> A description of the role
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Create a new IAM role with the specified name and optional description
EXAMPLES
$ flowcore iam create role data-reader -t my-org --description "Read-only data access"
$ flowcore iam create role admin -t my-org -jSee code: src/commands/create/role.ts
iam delete policy NAME
Delete a policy
USAGE
$ iam delete policy NAME -t <value> [--profile <value>] [-j] [-y]
ARGUMENTS
NAME name
FLAGS
-j, --json json output
-t, --tenant=<value> (required) tenant
-y, --yes yes to all
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Delete a policySee code: src/commands/delete/policy.ts
iam delete role NAME
Delete a role
USAGE
$ iam delete role NAME -t <value> [--profile <value>] [-j] [-y]
ARGUMENTS
NAME name
FLAGS
-j, --json json output
-t, --tenant=<value> (required) tenant
-y, --yes yes to all
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Delete a roleSee code: src/commands/delete/role.ts
iam edit policy NAME
Edit a policy in your preferred editor
USAGE
$ iam edit policy NAME -t <value> [--profile <value>]
ARGUMENTS
NAME name
FLAGS
-t, --tenant=<value> (required) tenant
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Edit a policy in your preferred editor
EXAMPLES
$ flowcore iam edit policy my-policy -t my-tenant
$ FC_EDITOR=code flowcore iam edit policy my-policy -t my-tenantSee code: src/commands/edit/policy.ts
iam edit role NAME
Edit a role in your preferred editor
USAGE
$ iam edit role NAME -t <value> [--profile <value>]
ARGUMENTS
NAME name
FLAGS
-t, --tenant=<value> (required) tenant
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Edit a role in your preferred editor
EXAMPLES
$ flowcore iam edit role my-role -t my-tenant
$ FC_EDITOR=code flowcore iam edit role my-role -t my-tenantSee code: src/commands/edit/role.ts
iam get key-policies KEY_ID
List all IAM policies assigned to a specific API key
USAGE
$ iam get key-policies KEY_ID [--profile <value>] [-j] [-w]
ARGUMENTS
KEY_ID The API key ID to get policies for
FLAGS
-j, --json Output result as JSON
-w, --wide Show additional columns in table output
--profile=<value> Specify the configuration profile to use
DESCRIPTION
List all IAM policies assigned to a specific API key
EXAMPLES
$ flowcore iam get key-policies "550e8400-e29b-41d4-a716-446655440000"
$ flowcore iam get key-policies "550e8400-e29b-41d4-a716-446655440000" -j
$ flowcore iam get key-policies "550e8400-e29b-41d4-a716-446655440000" -wSee code: src/commands/get/key-policies.ts
iam get key-roles KEY_ID
List all IAM roles assigned to a specific API key
USAGE
$ iam get key-roles KEY_ID [--profile <value>] [-j] [-w]
ARGUMENTS
KEY_ID The API key ID to get roles for
FLAGS
-j, --json Output result as JSON
-w, --wide Show additional columns in table output
--profile=<value> Specify the configuration profile to use
DESCRIPTION
List all IAM roles assigned to a specific API key
EXAMPLES
$ flowcore iam get key-roles "550e8400-e29b-41d4-a716-446655440000"
$ flowcore iam get key-roles "550e8400-e29b-41d4-a716-446655440000" -j
$ flowcore iam get key-roles "550e8400-e29b-41d4-a716-446655440000" -wSee code: src/commands/get/key-roles.ts
iam get policy [NAME]
Get a policy
USAGE
$ iam get policy [NAME] [--profile <value>] [-j] [-t <value>] [-w]
ARGUMENTS
NAME name
FLAGS
-j, --json json output
-t, --tenant=<value> tenant
-w, --wide wide output
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Get a policySee code: src/commands/get/policy.ts
iam get role [NAME]
Get a role
USAGE
$ iam get role [NAME] [--profile <value>] [-j] [-t <value>] [-w]
ARGUMENTS
NAME name
FLAGS
-j, --json json output
-t, --tenant=<value> tenant
-w, --wide wide output
--profile=<value> Specify the configuration profile to use
DESCRIPTION
Get a roleSee code: src/commands/get/role.ts
iam get user-policies USER_ID
List all IAM policies assigned to a specific user, optionally scoped to a tenant
USAGE
$ iam get user-policies USER_ID [--profile <value>] [-j] [-t <value>] [-w]
ARGUMENTS
USER_ID The user ID to get policies for (e.g. auth0|abc123)
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> Scope results to a specific tenant (organization slug)
-w, --wide Show additional columns in table output
--profile=<value> Specify the configuration profile to use
DESCRIPTION
List all IAM policies assigned to a specific user, optionally scoped to a tenant
EXAMPLES
$ flowcore iam get user-policies "auth0|abc123" -t my-org
$ flowcore iam get user-policies "auth0|abc123" -j
$ flowcore iam get user-policies "auth0|abc123" -t my-org -wSee code: src/commands/get/user-policies.ts
iam get user-roles USER_ID
List all IAM roles assigned to a specific user, optionally scoped to a tenant
USAGE
$ iam get user-roles USER_ID [--profile <value>] [-j] [-t <value>] [-w]
ARGUMENTS
USER_ID The user ID to get roles for (e.g. auth0|abc123)
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> Scope results to a specific tenant (organization slug)
-w, --wide Show additional columns in table output
--profile=<value> Specify the configuration profile to use
DESCRIPTION
List all IAM roles assigned to a specific user, optionally scoped to a tenant
EXAMPLES
$ flowcore iam get user-roles "auth0|abc123" -t my-org
$ flowcore iam get user-roles "auth0|abc123" -j
$ flowcore iam get user-roles "auth0|abc123" -t my-org -wSee code: src/commands/get/user-roles.ts
iam unassign policy POLICY_NAME
Remove an IAM policy assignment from a user, API key, or role. Exactly one of --user, --key, or --role must be specified
USAGE
$ iam unassign policy POLICY_NAME -t <value> [--profile <value>] [-j] [--key <value> | --user <value> | --role
<value>] [-y]
ARGUMENTS
POLICY_NAME The name of the policy to unassign
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) containing the policy
-y, --yes Skip confirmation prompt
--key=<value> The API key ID to unassign the policy from
--profile=<value> Specify the configuration profile to use
--role=<value> The role name to unassign the policy from
--user=<value> The user ID to unassign the policy from
DESCRIPTION
Remove an IAM policy assignment from a user, API key, or role. Exactly one of --user, --key, or --role must be
specified
EXAMPLES
$ flowcore iam unassign policy read-access --user "auth0|abc123" -t my-org -y
$ flowcore iam unassign policy read-access --key "550e8400-e29b-41d4-a716-446655440000" -t my-org -y
$ flowcore iam unassign policy read-access --role data-reader -t my-org -y
$ flowcore iam unassign policy read-access --user "auth0|abc123" -t my-org -j -ySee code: src/commands/unassign/policy.ts
iam unassign role ROLE_NAME
Remove an IAM role assignment from a user or API key. Exactly one of --user or --key must be specified
USAGE
$ iam unassign role ROLE_NAME -t <value> [--profile <value>] [-j] [--key <value> | --user <value>] [-y]
ARGUMENTS
ROLE_NAME The name of the role to unassign
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) containing the role
-y, --yes Skip confirmation prompt
--key=<value> The API key ID to unassign the role from
--profile=<value> Specify the configuration profile to use
--user=<value> The user ID to unassign the role from
DESCRIPTION
Remove an IAM role assignment from a user or API key. Exactly one of --user or --key must be specified
EXAMPLES
$ flowcore iam unassign role data-reader --user "auth0|abc123" -t my-org -y
$ flowcore iam unassign role data-reader --key "550e8400-e29b-41d4-a716-446655440000" -t my-org -y
$ flowcore iam unassign role data-reader --user "auth0|abc123" -t my-org -j -ySee code: src/commands/unassign/role.ts
iam validate key KEY_ID
Validate whether an API key has permission to perform an action on one or more resources
USAGE
$ iam validate key KEY_ID --action <value> --resource <value>... -t <value> [--profile <value>] [-j]
ARGUMENTS
KEY_ID The API key ID to validate access for
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) to validate within
--action=<value> (required) The action to validate (e.g. read, write, ingest, fetch)
--profile=<value> Specify the configuration profile to use
--resource=<value>... (required) The resource FRN to validate against (can be specified multiple times)
DESCRIPTION
Validate whether an API key has permission to perform an action on one or more resources
EXAMPLES
$ flowcore iam validate key "550e8400-e29b-41d4-a716-446655440000" -t my-org --action ingest --resource "frn::my-org:event-type/*"
$ flowcore iam validate key "550e8400-e29b-41d4-a716-446655440000" -t my-org --action read --resource "frn::my-org:data-core/my-core" -j
$ flowcore iam validate key "550e8400-e29b-41d4-a716-446655440000" -t my-org --action read --resource "frn::my-org:data-core/core1" --resource "frn::my-org:data-core/core2"See code: src/commands/validate/key.ts
iam validate user USER_ID
Validate whether a user has permission to perform an action on one or more resources
USAGE
$ iam validate user USER_ID --action <value> --resource <value>... -t <value> [--profile <value>] [-j]
ARGUMENTS
USER_ID The user ID to validate access for (e.g. auth0|abc123)
FLAGS
-j, --json Output result as JSON
-t, --tenant=<value> (required) The tenant (organization slug) to validate within
--action=<value> (required) The action to validate (e.g. read, write, ingest, fetch)
--profile=<value> Specify the configuration profile to use
--resource=<value>... (required) The resource FRN to validate against (can be specified multiple times)
DESCRIPTION
Validate whether a user has permission to perform an action on one or more resources
EXAMPLES
$ flowcore iam validate user "auth0|abc123" -t my-org --action read --resource "frn::my-org:data-core/my-core"
$ flowcore iam validate user "auth0|abc123" -t my-org --action write --resource "frn::my-org:data-core/*" -j
$ flowcore iam validate user "auth0|abc123" -t my-org --action read --resource "frn::my-org:data-core/core1" --resource "frn::my-org:data-core/core2"See code: src/commands/validate/user.ts
