Managing SIMs in a Group

The SIMs in this group tab on a group's settings page lists the IoT SIMs that belong to the group. This view provides almost all of the functionality of the SIM Management screen, but limits the results to the SIMs that belong to the selected group.

To open this tab, Sign in to the User Console. From the Menu, open the Groups screen. Click the Name of the group you want to view, then select the SIMs in this group tab.

Controlling Which SIMs a SAM User Can See

The SIMs in this group tab retrieves its list using the Query:searchSimsByGroup API, which specifies the group ID in the API path. Because SAM conditions can evaluate path variables, you can grant a SAM user permission to list and search only the SIMs that belong to a specific group:

{
  "statements": [
    {
      "effect": "allow",
      "api": ["Query:searchSimsByGroup"],
      "condition": "pathVariable('group_id') == '<group ID>'"
    }
  ]
}

When your goal is to limit which SIMs a SAM user can see, do not also grant permissions that list SIMs regardless of group, such as the Query:searchSims API, Sim:listSims API, or Subscriber:listSubscribers API.

For more information on writing permissions, refer to the Users & Roles documentation.

Limitations

Only listing and searching SIMs (the Query:searchSimsByGroup API) can be restricted per group. APIs that operate on an individual SIM — such as the Sim:getSim API, Sim:activateSim API, or Sim:terminateSim API — specify a SIM ID rather than a group ID, and therefore cannot be restricted using a group condition.

If you grant a SAM user permissions for SIM operation APIs, the User Console will only show the SIMs that belong to the allowed group, but the SAM user can still call those APIs against a SIM outside the group if they know its SIM ID. To strictly prohibit operations on SIMs outside a group, allow the operation APIs individually per SIM using a pathVariable('sim_id') condition instead.