fm iam
Reference for the fm iam command group (auto-generated from fm iam --help).
fm iam
text
Manage customer IAM access policies (ADR-0102).
Author least-privilege access policies for your API keys and workload identities,
bundle principals into groups, and test a policy before it takes effect.
Access policies can only be managed from an interactive OIDC session (fm auth
login), never from an API key or workload token.
Usage:
fm iam [command]
Available Commands:
catalog List the operation catalog policies are written against
group Manage principal groups
policy Manage access policies
simulate Test whether a policy would allow an operation (dry-run)
Flags:
-h, --help help for iam
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm iam [command] --help" for more information about a command.fm iam catalog
text
List the append-only operation taxonomy (svc:resource:action) that access
policies are authored against. The catalog is served by the platform — no client
hardcodes a copy.
Use --filter to narrow the list (substring match).
Usage:
fm iam catalog [flags]
Flags:
--filter string only show operations containing this substring
-h, --help help for catalog
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group
text
Manage principal groups
Usage:
fm iam group [command]
Aliases:
group, groups
Available Commands:
create Create a group
delete Delete a group
get Get a group
list List groups
member Manage group members
update Update a group
Flags:
-h, --help help for group
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm iam group [command] --help" for more information about a command.fm iam group create
text
Create a group
Usage:
fm iam group create [flags]
Flags:
--description string group description
-h, --help help for create
--name string group name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group delete
text
Delete a group. Its membership and group attachments are removed with it.
Usage:
fm iam group delete <id> [flags]
Flags:
--force skip confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group get
text
Get a group
Usage:
fm iam group get <id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group list
text
List groups
Usage:
fm iam group list [flags]
Flags:
--all fetch all pages (auto-follow nextCursor)
--cursor string opaque pagination cursor from a previous response's nextCursor
-h, --help help for list
--limit int maximum items per page
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group member
text
Manage group members
Usage:
fm iam group member [command]
Aliases:
member, members
Available Commands:
add Add a principal to a group
list List a group's members
remove Remove a principal from a group
Flags:
-h, --help help for member
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm iam group member [command] --help" for more information about a command.fm iam group member add
text
Add an API key or workload identity to a group.
Examples:
fm iam group member add <group-id> --type api_key --id <key-id>
Usage:
fm iam group member add <group-id> [flags]
Flags:
-h, --help help for add
--id string principal id (required)
--type string principal type: api_key or workload_identity (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group member list
text
List a group's members
Usage:
fm iam group member list <group-id> [flags]
Flags:
--all fetch all pages (auto-follow nextCursor)
--cursor string opaque pagination cursor from a previous response's nextCursor
-h, --help help for list
--limit int maximum items per page
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group member remove
text
Remove a principal from a group
Usage:
fm iam group member remove <group-id> [flags]
Flags:
-h, --help help for remove
--id string principal id (required)
--type string principal type: api_key or workload_identity (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam group update
text
Update a group
Usage:
fm iam group update <id> [flags]
Flags:
--description string new group description
-h, --help help for update
--name string new group name
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy
text
Manage access policies
Usage:
fm iam policy [command]
Aliases:
policy, policies
Available Commands:
attach Attach a policy to a principal or group
attachments List a policy's attachments
create Create an access policy
delete Delete an access policy
detach Detach a policy from a principal or group
get Get an access policy
list List access policies
update Update an access policy
Flags:
-h, --help help for policy
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)
Use "fm iam policy [command] --help" for more information about a command.fm iam policy attach
text
Attach an access policy to an API key, workload identity, or group.
Examples:
fm iam policy attach <policy-id> --type api_key --id <key-id>
fm iam policy attach <policy-id> --type group --id <group-id>
Usage:
fm iam policy attach <policy-id> [flags]
Flags:
-h, --help help for attach
--id string attachee id (required)
--type string attachee type: api_key, workload_identity, or group (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy attachments
text
List a policy's attachments
Usage:
fm iam policy attachments <policy-id> [flags]
Flags:
--all fetch all pages (auto-follow nextCursor)
--cursor string opaque pagination cursor from a previous response's nextCursor
-h, --help help for attachments
--id string filter to one attachee id (with --type)
--limit int maximum items per page
--type string filter to one attachee type: api_key, workload_identity, or group (with --id)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy create
text
Create a shared access policy from a policy document.
The document is a single access-policy object {schemaVersion, rules[]}. It is
validated and capped to your own authority server-side — you cannot author a
policy that grants more than you already hold.
Examples:
fm iam policy create --name read-only --document @policy.json
cat policy.json | fm iam policy create --name read-only --document -
fm iam policy create --name read-only --document '{"schemaVersion":"...","rules":[...]}'
Usage:
fm iam policy create [flags]
Flags:
--description string policy description
--document string policy document: inline JSON, @file, or - for stdin (required)
-h, --help help for create
--name string policy name (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy delete
text
Delete an access policy. Its attachments are removed with it.
Usage:
fm iam policy delete <id> [flags]
Flags:
--force skip confirmation prompt
-h, --help help for delete
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy detach
text
Detach a policy from a principal or group
Usage:
fm iam policy detach <policy-id> [flags]
Flags:
-h, --help help for detach
--id string attachee id (required)
--type string attachee type: api_key, workload_identity, or group (required)
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy get
text
Get an access policy
Usage:
fm iam policy get <id> [flags]
Flags:
-h, --help help for get
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy list
text
List the current tenant's access policies.
Results are cursor-paginated: when the output includes a non-empty nextCursor,
pass it back with --cursor to fetch the next page (or use --all).
Usage:
fm iam policy list [flags]
Flags:
--all fetch all pages (auto-follow nextCursor)
--cursor string opaque pagination cursor from a previous response's nextCursor
-h, --help help for list
--limit int maximum items per page
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam policy update
text
Update an access policy's name, description, or document. Only the flags you
pass are changed.
Examples:
fm iam policy update <id> --name new-name
fm iam policy update <id> --document @policy.json
Usage:
fm iam policy update <id> [flags]
Flags:
--description string new policy description
--document string new policy document: inline JSON, @file, or - for stdin
-h, --help help for update
--name string new policy name
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output
--tenant string tenant ID to operate on (overrides the active/default tenant; also FM_TENANT)fm iam simulate
text
Dry-run the policy evaluator against a candidate document: "given this policy,
would OPERATION on TARGET (under these constraints) be allowed?". It never persists
or enforces — use it to confirm a policy's effect before saving it.
Examples:
fm iam simulate --document @policy.json --operation compute:instances:read --target '*'
fm iam simulate --document @policy.json --operation storage:volumes:delete \
--target 'frn:storage:sweden:*:volumes/vol-123' --region sweden
Usage:
fm iam simulate [flags]
Aliases:
simulate, test
Flags:
--document string candidate policy document: inline JSON, @file, or - for stdin (required)
-h, --help help for simulate
--operation string operation to test, e.g. compute:instances:read (required)
--principal-type string hypothetical principal type constraint
--region string hypothetical request region constraint
--request-tag strings hypothetical request tags in key=value format (comma-separated)
--resource-tag strings hypothetical resource tags in key=value format (comma-separated)
--source-ip string hypothetical source IP constraint
--target string target FRN or * to test against (required)
--tenant string hypothetical tenant constraint
Global Flags:
--config string config file (default is $HOME/.fm/config.yaml)
-d, --debug enable debug/verbose output
--no-color disable colored output
-o, --output string output format: table, json, yaml, wide (default "table")
-q, --quiet suppress non-essential output