IBM Cloud

Connect IBM Cloud to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In IBM Cloud:

   1. In the IBM Cloud console, go to Manage › Access (IAM) and select Service IDs.
   2. (Optional) Select a group from the Service ID group menu (the default group is preselected; a service ID cannot be moved to another group later).
   3. Click Create, enter a name and description for the service ID, and click Create.
   4. Back on Service IDs, click the Actions icon for the service ID › Manage service ID.
   5. Click API keys, then click Create.
   6. Add a name and description for the API key and click Create.
   7. Save the API key by copying or downloading it to a secure location. It is only available at creation time.
   8. In Manage › Access (IAM) › Service IDs, click the Actions icon for the service ID › Assign access.
   9. Select a group of services (for account-wide read access, the service group or All Identity and Access enabled services) or a single service, then click Next.
   10. Scope the access to all resources in the account (or to specific resources by attribute) and click Next.
   11. Select the Viewer platform role and the Reader service role, then click Review.
   12. Click Add to add the policy to the policy summary, then click Assign.

   Where to find the other values:

   • Account ID (optional): Manage › Account › Account settings shows your account ID.
   • Regions (optional): Not documented in the IBM pages checked.

   IBM Cloud shows the secret only once, so copy it before you leave the page.

   Sourced from the Markdown sources of IBM Cloud docs in IBM's official ibm-cloud-docs GitHub organization (cloud.ibm.com/docs returned HTTP 500 earlier). If 'Restrict service ID creation' is enabled in IAM account settings, creating a service ID needs explicit access. Assigning access to a service ID requires the Administrator role on the IAM Identity service or that service ID. IBM notes that without at least Viewer on the resource group, an identity can see but not access resources in it. A user API key (Manage › Access (IAM) › API keys) is an alternative but inherits the user's full access; a service ID key is the least-privilege option. The Regions field has no documented single UI location.

   Source: raw.githubusercontent.com, raw.githubusercontent.com, raw.githubusercontent.com, raw.githubusercontent.com, cloud.ibm.com, checked 2026-10-07.

   The permissions Safeguard needs: Viewer (platform), Reader (service).

2. On Compliance › Connectors, open IBM Cloud, click Connect, choose API token and fill in:

   Field	What to enter
   API key	Required. Stored encrypted and never shown again.
   Account ID (optional)	—
   Regions (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read IBM Cloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks