---
title: "IAM Users"
date: 2024-08-12
tags: ["New"]
url: https://changelog.exoscale.com/iam-users/
---
# IAM Users

<div class="">
 So far IAM would let you create keys that could be restricted and fine tuned in their permissions. While practical and powerful, IAM Keys have always been intended for programmatic usage, while users could not be limited in scope beyond the predefined roles:
</div>
<div class="">
 <ul>
  <li>Owner</li>
  <li>Tech</li>
  <li>Admin</li>
 </ul>
</div>
<div>
 We are now extending the very same IAM functionality to users of Organizations.
</div>
<div>
 This means you will now be able to limit the scope of action of a user in the web portal in the same way as you would do for an IAM Key, with precise and fine grained IAM Roles.
</div>
<div>
 Typical use cases include:
</div>
<div class="">
 <ul>
  <li>give a user read-only access</li>
  <li>restrict a user to a specific service class, as e.g. sos for Object Storage operations</li>
  <li>generally, fine tune what a user can see or do in the web portal</li>
 </ul>
</div>
<div>
 It is important to note that:
</div>
<div class="">
 <ul>
  <li>All new Organizations will immediately start with IAM Users</li>
  <li>All existing Organizations will be migrated to IAM Users on the 16th of September 2024</li>
  <li>You have the ability at any point in time before the 16th of September 2024 to willingly migrate your existing Organizations to the new system accessing:&nbsp;<a href="https://portal.exoscale.com/notification" target="_blank" rel="noopener nofollow">https://portal.exoscale.com/notifications</a></li>
  <li><b>Once migrated, it is not possible to revert to the "Legacy Roles"</b></li>
 </ul>
</div>
<div class="">
 For more information, you can refer to our IAM Documentation:&nbsp;<a href="https://community.exoscale.com/documentation/iam/" target="_blank" rel="noopener nofollow">https://community.exoscale.com/documentation/iam/</a>
</div>
<h2>Migration from "Legacy Roles" to IAM Users for existing Organizations</h2>
<div class="">
 When migrating to to IAM Users, three default IAM Roles will be created for your existing Organization. Those will have almost the same names as the "Legacy Roles" you might be used to:
</div>
<div class="">
 <ul>
  <li>Owner</li>
  <li>Tech</li>
  <li>Billing (was "Admin")</li>
 </ul>
</div>
<div class="">
 The new IAM Roles will have defined policies that will port all existing functionalities to existing users.
</div>
<div class="">
 This means <b>you do not need to act or modify anything if the current "Legacy Roles" suit you. No difference in behaviour should be expected after migration.</b>&nbsp;Existing users will be attributed to the proper IAM Role based on their "Legacy Role".
</div>
<div class="">
 After migration you have the ability to modify the Tech IAM Role's Policy to your needs, while the Owner and Billing IAM Roles will be immutable. You can also create new IAM Roles and assign them to existing users.
</div>
<div class="">
 If you have any question or doubt do not hesitate to contact our support team.
</div>