fixing display messages + update policy logic (#281)

* fixing adding missing permissions if service already exists with different permissions

* fixing display messages

* fixing readme

* updating readme

* fixing pre-commit

---------

Co-authored-by: Nupur Goyal <[email protected]>

Author: nupurg-ibm

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2025-09-17T10:23:03Z",
+  "generated_at": "2025-09-24T15:40:32Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -108,15 +108,15 @@
         "hashed_secret": "89a6cfe2a229151e8055abee107d45ed087bbb4f",
         "is_secret": true,
         "is_verified": false,
-        "line_number": 36,
+        "line_number": 28,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "365b78d42089abe4583503eded60fa7c1b3e1cd0",
         "is_secret": true,
         "is_verified": false,
-        "line_number": 56,
+        "line_number": 47,
         "type": "Secret Keyword",
         "verified_result": null
       }

tools/access-management/README.md

@@ -1,13 +1,60 @@
 # IAM Permissions Assignment for LSF Deployment
 
-### Before deploying an IBM Cloud LSF cluster, specific IAM permissions must be assigned to either a user or an access group. This script automates that process.
+#### Before deploying an IBM Spectrum LSF cluster, specific IAM permissions must be assigned to either a user or an access group. The automation script enables this process.
 
-How to run:
+User has the flexibility to run the specific scripts to gain the required IAM permissions to perform the LSF deployment. The automation ensures that if the user has a certain permissions, then the script will omit them and add only the required permissions to perform the deployment.
+
+For example, for the App configuration service, the user requires Administrator and Manager permissions. If the user already has the Administrator permission, then the script will omit this and provide only Manager permission.
+
+### Benefits of the scripts:
+
+#### Interactive input collection - The script prompts for the IBMid (admin email), Resource Group ID, Account ID, and target (User or Access Group).
+
+#### Permission check - The script verifies that the admin has account-level Administrator rights which is required to assign policies.
+
+#### Assigns required permissions for LSF deployment - This script grants the appropriate permissions across IBM Cloud services that LSF depends upon (for example, VPC, COS, DNS services, KMS, Secrets Manager, and Sysdig Monitoring).
+
+#### Avoids duplicates - The script skips the assignment if a matching policy already exists.
+
+You can get the scripts by performing gitclone on the branch:
 
 ```
-ibmcloud login --apikey <YOUR_API_KEY> -g <RESOURCE_GROUP>
+git clone -b main https://github.com/terraform-ibm-modules/terraform-ibm-hpc.git
+```
 
-chmod +x permissions.sh
+1. Navigate to cd tools/access-management, you will get the permissions.sh file.
+
+2. Login to the IBM Cloud with your API key. Run the following command:
 
+```
+ibmcloud login --apikey <YOUR_API_KEY> -g <RESOURCE_GROUP>
+chmod +x permissions.sh
 ./permissions.sh
 ```
+
+3. Enter the admin email or IBMid.
+
+4. Enter the Resource group and Account ID.
+
+For the Account ID, login to the IBM Cloud account by using your unique credentials. Go to Manage > Account > Account settings. You will find the Account ID.
+
+5. You will be asked to assign the roles:
+
+```
+Access Group - Select this option, if you want to assign the access to the entire access group.
+User - Select this option, if you want to assign the access to an individual user.
+Select the required option.
+```
+
+6. Enter the target user email, if you select the option 2.
+
+7. User policy is successfully created.
+
+If the user skips to enter the RESOURCE_GROUP_ID or the ACCOUNT_ID, then script displays the error message:
+
+```
+:x: RESOURCE_GROUP_ID is required.
+:x: ACCOUNT_ID is required.
+```
+
+This script ensures the user or access group has all the required IAM permissions to successfully deploy an LSF environment.