IBM Cloud Explained: Accounts, Resource Groups, Watson, and Kubernetes

Account types and the enterprise hierarchy

IBM Cloud accounts come in a few types. A free or trial account lets you try a limited catalogue with no charge; the exact terms, duration and services included are set by IBM and change over time. A Pay-As-You-Go account adds a payment method and unlocks the full catalogue, billed monthly on usage. A Subscription account commits to a spend amount in exchange for a discount. Above those, an Enterprise account groups many child accounts into a hierarchy so a large organisation can see combined billing and apply settings from the top.

The listing on the CloudAccountHub product page is labelled IBM Cloud Free Trial, which restates the account type as listed. What a trial includes, and how it converts to a paid type, is defined by IBM’s current terms on its free tier page.

Resource groups and IAM

Every service instance you create in IBM Cloud belongs to a resource group. Resource groups are the unit of organisation inside an account: they let you split resources by project, team or environment and attach access policies at that level. An account starts with a default group; most teams add one per application or per environment such as dev, staging and prod.

Access is controlled by IBM Cloud IAM. Users log in with an IBMid and are invited into an account. Policies grant a subject (a user, an access group, or a service ID) a role on a target, which can be a whole service, a single instance, a resource group or the account itself. Roles are split into platform roles (Viewer, Operator, Editor, Administrator) that control lifecycle actions and service roles (Reader, Writer, Manager) that control the data plane. Access groups are the practical way to manage people: put users in groups, attach policies to groups.

For automation, service IDs carry API keys and can be given the same kinds of policies as users. Trusted profiles let compute resources or federated identities assume access without a long-lived key. Multi-factor authentication can be enforced for the whole account from IAM settings, and IBM recommends it for every account owner.

Resource group

Container for service instances; scope for access policies

Access group

Set of users and service IDs that share policies

Service ID

Non-human identity with API keys for applications

Trusted profile

Identity that compute or federated users can assume

Regions, multizone regions and classic data centres

IBM Cloud has two generations of infrastructure. Classic infrastructure is the original SoftLayer footprint: data centres identified by codes such as dal10 or fra02, with classic virtual servers, bare metal and VLAN-based networking. VPC infrastructure is the newer software-defined model, organised into multizone regions (MZRs) that each contain three availability zones. MZRs include Dallas (us-south), Washington DC (us-east), Toronto, São Paulo, London, Frankfurt, Madrid, Tokyo, Osaka and Sydney. Most new deployments should use VPC infrastructure unless they need a classic-only feature such as certain bare metal configurations.

Some services are regional (a VPC, a Kubernetes cluster, a database instance) and some are global (IAM, billing, Cloud Object Storage’s cross-region buckets). When you create a service the catalogue shows which locations it is available in, and not every service is offered in every region.

Core services: compute, Kubernetes, data and watsonx

Compute covers Virtual Servers for VPC (profiles balanced across CPU and memory, plus compute-, memory- and GPU-heavy families), Bare Metal Servers on both classic and VPC, and Power Virtual Server for AIX, IBM i and Linux on POWER. Code Engine is the serverless platform for containers, batch jobs and functions.

The IBM Cloud Kubernetes Service (IKS) is a managed Kubernetes offering where IBM runs the control plane and you manage worker pools. Red Hat OpenShift on IBM Cloud is the same idea with the OpenShift distribution on top. Both integrate with the VPC network, the container registry and Activity Tracker for audit events. Details are on the Kubernetes Service page.

Data services include Cloud Object Storage (S3-compatible), Db2, Cloudant (a CouchDB-derived document store) and the Databases for PostgreSQL, MySQL, Redis, MongoDB, Elasticsearch and etcd family. watsonx is the AI portfolio: watsonx.ai for training and serving foundation models, watsonx.data for a lakehouse layer, watsonx.governance for model oversight, plus the older Watson APIs for speech, natural language and conversational assistants.

Typical workloads are enterprise application platforms on OpenShift, regulated workloads that need IBM’s compliance programs, hybrid setups connected to on-premises IBM systems, and AI projects that want watsonx alongside their data. Developers also use the free tier for learning Kubernetes, testing Watson APIs and small proofs of concept.

Billing, usage and operational hygiene

Usage is metered per service and invoiced monthly. The Billing and usage page shows charges by resource group and by service, which is one more reason to keep resource groups tidy. Spending notifications can be set for the account so an email fires when usage crosses a threshold you choose. Some catalogue entries have a free plan (often called Lite) with fixed monthly allowances; when you exceed them the instance stops rather than charging, unless you upgrade to a paid plan.

Service quotas apply per account and per region, and many are raised by opening a support case with a stated use. The IBM Cloud CLI (ibmcloud), Schematics (managed Terraform) and the REST APIs cover everything the console does, so an account can be bootstrapped as code. Activity Tracker records management actions and should be turned on from the start. IBM’s terms of use and acceptable use policy apply to every account type, including trials.

Where to go next

• See the listed variant on the IBM Cloud account product page.
• Compare it with a rival enterprise platform in Oracle Cloud vs IBM Cloud.
• Read IAM basics across providers for how IBM’s model compares with AWS and Azure.
• See where IKS sits among managed offerings in Managed Kubernetes across providers.
• Follow the Cloud account handover checklist when you inherit an account.
• Browse every guide in the Cloud Library.