Cloud Access Management

This handles the full IAM workflow for Elastic Cloud Serverless: invite users, assign predefined or custom roles to projects, and create scoped API keys with optional Elasticsearch access. It assumes cloud-setup has already run and set EC_API_KEY in the environment. The Python script auto-discovers your org ID and enforces that only organization owners can manage API keys. For custom roles with fine-grained index or Kibana privileges, you'll need manage_security on the project itself. The documentation is thorough, covering both happy paths and the manual .env fallback when cloud-setup isn't available. Pairs with cloud-create-project for new projects and elasticsearch-authz for deeper role mapping work inside Elasticsearch.