Skip to main content
PATCH
Update instance
Requires the IAM action compute:UpdateInstance. See COMPUTE permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Path Parameters

instance_id
string<uuid>
required

Instance ID

Body

application/json
iam_role
string

Attach or replace the instance workload role using its ID, name, or CRN. Omit this field to keep the current role; send an empty string to detach it. Null is not accepted. Requires compute:UpdateInstance; attach/replace also require iam:PassRole and a role trust policy allowing this instance. Only running or stopped customer-managed instances with no operation in progress support role edits. Pool members use the pool launch template. New IMDS requests observe the committed association immediately. Previously issued credentials are not revoked and remain valid until expiry (up to one hour); in-flight requests may complete with their prior association.

Example:

"workload-role"

description
string
Maximum string length: 1000
Example:

"Primary web server"

metadata
object
Example:
tags
object
Example:

Response

Instance updated

instance
object
required