IAM governs access to the console and the API. The model is simple: users authenticate, roles define what they may do, and every action is audit-logged.

Users and Roles

Create a named account per person (Security → Users) and assign the least role that does the job. Built-in roles cover the common cases (Organization Admin, Operator, Auditor, Billing Viewer); custom roles grant fine-grained permissions — for example "manage VMs and disks in the staging resource group, read-only everywhere else".

Authentication Controls

• MFA — require time-based one-time passwords for all users (strongly recommended, enforced by policy)
• Password policy — minimum length, complexity, expiry, and reuse restrictions
• Source restrictions — limit console/API access to named IP ranges
• Session policy — idle timeout and maximum session lifetime
• Directory integration — authenticate against your Active Directory/LDAP so joiners and leavers are handled in one place

API Keys

API keys provide programmatic access with the permissions of their owning user. Best practice: one automation user per system (e.g. backup-automation, monitoring-readonly), each with a tightly scoped custom role and its own key, rotated on a schedule.

# Authenticate and call the API
TOKEN=$(curl -s -X POST "https://api.daakyicloud.com/v1/auth/tokens" \
  -H "Content-Type: application/json" \
  -d '{"api_key": "'$DAAKYI_API_KEY'"}' | jq -r .token)

curl -s "https://api.daakyicloud.com/v1/vms" \
  -H "Authorization: Bearer $TOKEN"

Audit Logging

Every console and API action is recorded: actor, action, target resource, source IP, timestamp, and result. Logs are searchable under Operations → Audit Logs and exportable for retention in your own systems.