The Pulse
Lambda Cloud Adds Free Role-Based Access Control
Lambda Cloud's identity and access management brings role-based access control to Lambda Cloud, with roles, groups and service identities in the console. IAM is free, and audit logs are kept for six months.
AI.info Team · Written with AI · fact-checked ·
Lambda Cloud introduced identity and access management (IAM) on November 4, bringing role-based access control (RBAC), with roles, groups and service identities in its console. Lambda says IAM lets administrators grant each person and program only the access its work requires. Until recently, Lambda Cloud had two roles, Admin and Member, and every API key carried its owner’s full access.
Workspaces decide where resources live, and IAM decides what someone can do once they're in one
To act on a resource in a workspace, an identity needs membership in that workspace and a role that permits the action.
Users can find IAM under Account > Configuration > IAM, where the console has tabs for users, service identities and groups. A user’s detail page lists their API keys, groups and roles, and provides a way to remove them. Roles live on each identity’s details page.
Service identities are accounts for software, with their own keys and roles
Service identities are accounts for software such as scripts and pipelines, and each has its own keys and roles. Lambda-managed service identities are labeled, and a few let Lambda perform operations on a customer’s behalf, such as maintenance. Lambda recommends giving automation its own identity: create a service identity for a script that runs on a personal key, grant only the roles it uses, and set an expiration date for its API key.
Each service identity can hold two keys at once, so keys can be rotated and one revoked from the identity’s details page. A personal API key stays live until it is deleted.
Group members inherit assigned roles
Groups can contain users and service identities, and members inherit roles assigned to the group. Groups can also join workspaces. Lambda recommends organizing groups by team or job so onboarding means adding a new hire to a group and offboarding means removing them in one place.
Roles bundle fine-grained permissions at account or workspace scope. The predefined set includes Account Admin, IAM Admin, Billing Admin, Workspace Owner, Workspace Member and Instance Reader. An effective access view shows every role an identity holds in each workspace, including anything inherited from a group.
Current API keys are untouched
Only account admins and IAM admins can see or change IAM. Your existing setup keeps working: Admin and Member map to Account Admin and Account Member, and current API keys are untouched. Lambda says audit logs cover keys, identities, workspaces and resources, are recorded automatically and are kept for six months.
Each account can have up to 100 groups and 50 service identities. Lambda says IAM is free and users pay only for the resources they run. Account admins and IAM admins can open IAM and create a service identity, with the predefined roles page listing what each role allows.