iam_create_policy

Instructions

Implementation Reference

• src/tools/iam/index.ts:288-307 (registration)

  Registration of iam_create_policy tool via server.tool() with name, description, Zod schema, and handler function.

  // ─── iam_create_policy ────────────────────────────────────────
  server.tool(
    "iam_create_policy",
    "Create a new IAM access policy",
    {
      type: z.enum(["access", "authorization"]).describe("Policy type"),
      subjects: z.string().describe("JSON string of policy subjects array"),
      roles: z.string().describe("JSON string of roles array (e.g., [{role_id: 'crn:v1:bluemix:public:iam::::role:Viewer'}])"),
      resources: z.string().describe("JSON string of resources array"),
    },
    async ({ type, subjects, roles, resources }) => safeTool(async () => {
      assertWriteAllowed(config.allowWrite);
      return client.post(`${IBM_ENDPOINTS.IAM_POLICY}/policies`, {
        type,
        subjects: JSON.parse(subjects),
        roles: JSON.parse(roles),
        resources: JSON.parse(resources),
      });
    })
  );

• src/tools/iam/index.ts:292-297 (schema)

  Zod schema defining input parameters: type (enum 'access'|'authorization'), subjects (JSON string), roles (JSON string), resources (JSON string).

  {
    type: z.enum(["access", "authorization"]).describe("Policy type"),
    subjects: z.string().describe("JSON string of policy subjects array"),
    roles: z.string().describe("JSON string of roles array (e.g., [{role_id: 'crn:v1:bluemix:public:iam::::role:Viewer'}])"),
    resources: z.string().describe("JSON string of resources array"),
  },

• src/tools/iam/index.ts:298-306 (handler)

  Handler function that asserts write access, then POSTs parsed JSON data to IBM IAM Policy API endpoint.

  async ({ type, subjects, roles, resources }) => safeTool(async () => {
    assertWriteAllowed(config.allowWrite);
    return client.post(`${IBM_ENDPOINTS.IAM_POLICY}/policies`, {
      type,
      subjects: JSON.parse(subjects),
      roles: JSON.parse(roles),
      resources: JSON.parse(resources),
    });
  })

• src/lib/utils.ts:14-18 (helper)

  assertWriteAllowed helper — throws WriteNotAllowedError if write operations are disabled.

  export function assertWriteAllowed(allowWrite: boolean): void {
    if (!allowWrite) {
      throw new WriteNotAllowedError();
    }
  }

• src/config.ts:26-30 (helper)

  IBM_ENDPOINTS.IAM_POLICY constant defining the base URL (https://iam.cloud.ibm.com/v1) used by the handler for POST request.

  export const IBM_ENDPOINTS = {
    IAM: "https://iam.cloud.ibm.com",
    IAM_IDENTITY: "https://iam.cloud.ibm.com/v1",
    IAM_ACCESS_GROUPS: "https://iam.cloud.ibm.com/v2",
    IAM_POLICY: "https://iam.cloud.ibm.com/v1",