> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and access management (IAM)

> CoreWeave's Identity and Access Management system for controlling access to Cloud Platform resources

CoreWeave Identity and Access Management (IAM) controls access to Cloud Platform resources using [IAM Access Policies](/security/iam/access-policies). These policies define which principals (users or groups) can perform specific actions across CoreWeave services.

Separate authorization mechanisms also apply to the following services:

| Authorization area                                                                                                                                                                                                             | Description                                                                                                                                            |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
| The [AI Object Storage S3-compatible API](/products/storage/object-storage/reference/object-storage-s3), which is governed by [organization and bucket access policies](/products/storage/object-storage/auth-access/policies) | Controls access to data in CoreWeave AI Object Storage.                                                                                                |
| CoreWeave Kubernetes Service (CKS) [authorization within clusters](/products/cks/auth-access/managed-auth/kubeconfig)                                                                                                          | Access and roles for Kubernetes resources managed by CKS.                                                                                              |
| SUNK cluster access, managed through [SUNK User Provisioning (SUP)](/products/sunk/manage_sunk/manage_cluster_access/sunk_user_provisioning)                                                                                   | SUP provisions CoreWeave IAM user and group data into POSIX identities in the cluster. IAM Access Policies do not directly govern SUNK cluster access. |

## Enterprise onboarding

When you onboard an organization, set up identity, provisioning, and least-privilege access in this order:

1. **Sign-in and SSO**: Configure [SAML SSO](/security/authn-authz/saml-sso/intro-saml-sso) so your team signs in through your identity provider. Use [Login Methods](/security/authn-authz/login-methods) to enable or disable each authentication method organization-wide, including turning off password-based sign-in to enforce SSO as the only sign-in path.
2. **Multi-factor authentication**: Each user can enable TOTP-based 2FA on their [account settings](https://console.coreweave.com/account/settings) page. For org-wide enforcement, configure your identity provider to require MFA on every SSO sign-in. See [Can I enforce 2FA for all users?](/support/platform/articles/can-i-enforce-2fa-for-all-users).
3. **User and group provisioning**: Sync users and groups from your identity provider with [Automated User Provisioning (AUP)](/security/automated-user-provisioning), which uses SCIM. Group memberships flow into IAM and can drive access policies.
4. **Least-privilege access**: Assign [IAM roles](/security/iam/access-policies/roles) through access policies. Use [Default Access Policies](/security/iam/access-policies#default-access-policies) to keep common access patterns current as CoreWeave ships new roles, and create custom policies for narrower access.

### Per-cluster access scoping

[Managed Authentication](/products/cks/auth-access/managed-auth/kubeconfig) allows all valid CoreWeave users in your organization to authenticate to any cluster in that organization. IAM roles scope what each user can do across all clusters. For more granular per-cluster control, configure a cluster to use [Unmanaged Authentication](/products/cks/auth-access/unmanaged-auth/introduction) with your own identity provider, or [contact support](/support/contact) about using multiple organizations for stronger separation. See [How do I scope users to specific clusters?](/support/platform/articles/how-do-i-scope-users-to-specific-clusters).

### Object Storage access without admin

Getting Object Storage credentials requires either the **Object Storage Admin** role or an [organization access policy](/products/storage/object-storage/auth-access/organization-policies/about) that grants the narrower `cwobject:CreateAccessKey` permission. To let users obtain credentials without the full admin role, grant them the `cwobject:CreateAccessKey` policy instead, then have them [exchange their API access token directly](/products/storage/object-storage/auth-access/manage-access-keys/api-access-token) for temporary credentials. Combine this with [group-based bucket policies](/products/storage/object-storage/auth-access/bucket-access/bucket-policies) so SCIM group memberships control which buckets each user can reach.

## Next steps

* Learn about [IAM Access Policies](/security/iam/access-policies).
* Create an [IAM Access Policy](/security/iam/access-policies/manage).


## Related topics

- [Introduction to CoreWeave Security](/security.md)