feat: Instance commands (#3385)

* fix: add events for domain

* fix: add/remove domain command side

* fix: add/remove domain command side

* fix: add/remove domain query side

* fix: create instance

* fix: merge v2

* fix: instance domain

* fix: instance domain

* fix: instance domain

* fix: instance domain

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from writemodels

* fix: remove domain.IAMID from api

* fix: remove domain.IAMID

* fix: remove domain.IAMID

* fix: add instance domain queries

* fix: fix after merge

* Update auth_request.go

* fix keypair

* remove unused code

* feat: read instance id from context

* feat: remove unused code

* feat: use instance id from context

* some fixes

Co-authored-by: Livio Amstutz <[email protected]>

internal/command/instancce_policy_password_age_model.go

@@ -3,9 +3,9 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 )
@@ -14,12 +14,12 @@ type InstancePasswordAgePolicyWriteModel struct {
 	PasswordAgePolicyWriteModel
 }
 
-func NewInstancePasswordAgePolicyWriteModel() *InstancePasswordAgePolicyWriteModel {
+func NewInstancePasswordAgePolicyWriteModel(ctx context.Context) *InstancePasswordAgePolicyWriteModel {
 	return &InstancePasswordAgePolicyWriteModel{
 		PasswordAgePolicyWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance.go

@@ -1,74 +0,0 @@
-package command
-
-import (
-	"context"
-
-	"github.com/caos/zitadel/internal/domain"
-	caos_errs "github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore"
-	"github.com/caos/zitadel/internal/repository/instance"
-	"github.com/caos/zitadel/internal/telemetry/tracing"
-	"golang.org/x/text/language"
-)
-
-//TODO: private as soon as setup uses query
-func (c *Commands) GetInstance(ctx context.Context) (*domain.Instance, error) {
-	iamWriteModel := NewInstanceWriteModel()
-	err := c.eventstore.FilterToQueryReducer(ctx, iamWriteModel)
-	if err != nil {
-		return nil, err
-	}
-	return writeModelToInstance(iamWriteModel), nil
-}
-
-func (c *Commands) setGlobalOrg(ctx context.Context, iamAgg *eventstore.Aggregate, iamWriteModel *InstanceWriteModel, orgID string) (eventstore.Command, error) {
-	err := c.eventstore.FilterToQueryReducer(ctx, iamWriteModel)
-	if err != nil {
-		return nil, err
-	}
-	if iamWriteModel.GlobalOrgID != "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-HGG24", "Errors.IAM.GlobalOrgAlreadySet")
-	}
-	return instance.NewGlobalOrgSetEventEvent(ctx, iamAgg, orgID), nil
-}
-
-func (c *Commands) setIAMProject(ctx context.Context, iamAgg *eventstore.Aggregate, iamWriteModel *InstanceWriteModel, projectID string) (eventstore.Command, error) {
-	err := c.eventstore.FilterToQueryReducer(ctx, iamWriteModel)
-	if err != nil {
-		return nil, err
-	}
-	if iamWriteModel.ProjectID != "" {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "IAM-EGbw2", "Errors.IAM.IAMProjectAlreadySet")
-	}
-	return instance.NewIAMProjectSetEvent(ctx, iamAgg, projectID), nil
-}
-
-func (c *Commands) SetDefaultLanguage(ctx context.Context, language language.Tag) (*domain.ObjectDetails, error) {
-	iamWriteModel, err := c.getIAMWriteModel(ctx)
-	if err != nil {
-		return nil, err
-	}
-	iamAgg := InstanceAggregateFromWriteModel(&iamWriteModel.WriteModel)
-	pushedEvents, err := c.eventstore.Push(ctx, instance.NewDefaultLanguageSetEvent(ctx, iamAgg, language))
-	if err != nil {
-		return nil, err
-	}
-	err = AppendAndReduce(iamWriteModel, pushedEvents...)
-	if err != nil {
-		return nil, err
-	}
-	return writeModelToObjectDetails(&iamWriteModel.WriteModel), nil
-}
-
-func (c *Commands) getIAMWriteModel(ctx context.Context) (_ *InstanceWriteModel, err error) {
-	ctx, span := tracing.NewSpan(ctx)
-	defer func() { span.EndWithError(err) }()
-
-	writeModel := NewInstanceWriteModel()
-	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
-	if err != nil {
-		return nil, err
-	}
-
-	return writeModel, nil
-}

internal/command/instance_converter.go

@@ -8,6 +8,7 @@ import (
 
 func writeModelToObjectRoot(writeModel eventstore.WriteModel) models.ObjectRoot {
 	return models.ObjectRoot{
+		InstanceID:    writeModel.InstanceID,
 		AggregateID:   writeModel.AggregateID,
 		ChangeDate:    writeModel.ChangeDate,
 		ResourceOwner: writeModel.ResourceOwner,
@@ -15,16 +16,6 @@ func writeModelToObjectRoot(writeModel eventstore.WriteModel) models.ObjectRoot
 	}
 }
 
-func writeModelToInstance(wm *InstanceWriteModel) *domain.Instance {
-	return &domain.Instance{
-		ObjectRoot:   writeModelToObjectRoot(wm.WriteModel),
-		SetUpStarted: wm.SetUpStarted,
-		SetUpDone:    wm.SetUpDone,
-		GlobalOrgID:  wm.GlobalOrgID,
-		IAMProjectID: wm.ProjectID,
-	}
-}
-
 func memberWriteModelToMember(writeModel *MemberWriteModel) *domain.Member {
 	return &domain.Member{
 		ObjectRoot: writeModelToObjectRoot(writeModel.WriteModel),

internal/command/instance_custom_login_text.go

@@ -3,6 +3,7 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"golang.org/x/text/language"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -12,7 +13,7 @@ import (
 )
 
 func (c *Commands) SetCustomInstanceLoginText(ctx context.Context, loginText *domain.CustomLoginText) (*domain.ObjectDetails, error) {
-	iamAgg := instance.NewAggregate()
+	iamAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID())
 	events, existingMailText, err := c.setCustomInstanceLoginText(ctx, &iamAgg.Aggregate, loginText)
 	if err != nil {
 		return nil, err
@@ -62,7 +63,7 @@ func (c *Commands) setCustomInstanceLoginText(ctx context.Context, instanceAgg *
 }
 
 func (c *Commands) defaultLoginTextWriteModelByID(ctx context.Context, lang language.Tag) (*InstanceCustomLoginTextReadModel, error) {
-	writeModel := NewInstanceCustomLoginTextReadModel(lang)
+	writeModel := NewInstanceCustomLoginTextReadModel(ctx, lang)
 	err := c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_custom_login_text_model.go

@@ -1,9 +1,11 @@
 package command
 
 import (
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"golang.org/x/text/language"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
@@ -12,12 +14,12 @@ type InstanceCustomLoginTextReadModel struct {
 	CustomLoginTextReadModel
 }
 
-func NewInstanceCustomLoginTextReadModel(lang language.Tag) *InstanceCustomLoginTextReadModel {
+func NewInstanceCustomLoginTextReadModel(ctx context.Context, lang language.Tag) *InstanceCustomLoginTextReadModel {
 	return &InstanceCustomLoginTextReadModel{
 		CustomLoginTextReadModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			Language: lang,
 		},

internal/command/instance_custom_message_text.go

@@ -10,8 +10,8 @@ import (
 	"golang.org/x/text/language"
 )
 
-func (c *Commands) SetDefaultMessageText(ctx context.Context, messageText *domain.CustomMessageText) (*domain.ObjectDetails, error) {
-	instanceAgg := instance.NewAggregate()
+func (c *Commands) SetDefaultMessageText(ctx context.Context, instanceID string, messageText *domain.CustomMessageText) (*domain.ObjectDetails, error) {
+	instanceAgg := instance.NewAggregate(instanceID)
 	events, existingMessageText, err := c.setDefaultMessageText(ctx, &instanceAgg.Aggregate, messageText)
 	if err != nil {
 		return nil, err
@@ -114,7 +114,7 @@ func (c *Commands) RemoveInstanceMessageTexts(ctx context.Context, messageTextTy
 }
 
 func (c *Commands) defaultCustomMessageTextWriteModelByID(ctx context.Context, messageType string, lang language.Tag) (*InstanceCustomMessageTextWriteModel, error) {
-	writeModel := NewInstanceCustomMessageTextWriteModel(messageType, lang)
+	writeModel := NewInstanceCustomMessageTextWriteModel(ctx, messageType, lang)
 	err := c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_custom_message_text_model.go

@@ -1,9 +1,11 @@
 package command
 
 import (
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"golang.org/x/text/language"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
@@ -12,12 +14,12 @@ type InstanceCustomMessageTextWriteModel struct {
 	CustomMessageTextReadModel
 }
 
-func NewInstanceCustomMessageTextWriteModel(messageTextType string, lang language.Tag) *InstanceCustomMessageTextWriteModel {
+func NewInstanceCustomMessageTextWriteModel(ctx context.Context, messageTextType string, lang language.Tag) *InstanceCustomMessageTextWriteModel {
 	return &InstanceCustomMessageTextWriteModel{
 		CustomMessageTextReadModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			MessageTextType: messageTextType,
 			Language:        lang,

internal/command/instance_custom_message_text_test.go

@@ -19,8 +19,9 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx    context.Context
-		config *domain.CustomMessageText
+		ctx        context.Context
+		instanceID string
+		config     *domain.CustomMessageText
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -40,8 +41,9 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx:    context.Background(),
-				config: &domain.CustomMessageText{},
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				config:     &domain.CustomMessageText{},
 			},
 			res: res{
 				err: caos_errs.IsErrorInvalidArgument,
@@ -57,7 +59,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessageGreeting,
 									"Greeting",
@@ -66,7 +68,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessageSubject,
 									"Subject",
@@ -75,7 +77,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessageTitle,
 									"Title",
@@ -84,7 +86,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessagePreHeader,
 									"PreHeader",
@@ -93,7 +95,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessageText,
 									"Text",
@@ -102,7 +104,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessageButtonText,
 									"ButtonText",
@@ -111,7 +113,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewCustomTextSetEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"Template",
 									domain.MessageFooterText,
 									"Footer",
@@ -123,7 +125,8 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.CustomMessageText{
 					MessageTextType: "Template",
 					Language:        language.English,
@@ -138,7 +141,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -148,7 +151,7 @@ func TestCommandSide_SetDefaultMessageText(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore,
 			}
-			got, err := r.SetDefaultMessageText(tt.args.ctx, tt.args.config)
+			got, err := r.SetDefaultMessageText(tt.args.ctx, tt.args.instanceID, tt.args.config)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}

internal/command/instance_custom_text.go

@@ -13,7 +13,7 @@ import (
 )
 
 func (c *Commands) SetInstanceCustomText(ctx context.Context, customText *domain.CustomText) (*domain.CustomText, error) {
-	setText := NewInstanceCustomTextWriteModel(customText.Key, customText.Language)
+	setText := NewInstanceCustomTextWriteModel(ctx, customText.Key, customText.Language)
 	instanceAgg := InstanceAggregateFromWriteModel(&setText.CustomTextWriteModel.WriteModel)
 	event, err := c.setDefaultCustomText(ctx, instanceAgg, setText, customText)
 	if err != nil {
@@ -52,7 +52,7 @@ func (c *Commands) defaultCustomTextWriteModelByID(ctx context.Context, key stri
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceCustomTextWriteModel(key, language)
+	writeModel := NewInstanceCustomTextWriteModel(ctx, key, language)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_custom_text_model.go

@@ -1,9 +1,11 @@
 package command
 
 import (
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"golang.org/x/text/language"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
@@ -12,12 +14,12 @@ type InstanceCustomTextWriteModel struct {
 	CustomTextWriteModel
 }
 
-func NewInstanceCustomTextWriteModel(key string, language language.Tag) *InstanceCustomTextWriteModel {
+func NewInstanceCustomTextWriteModel(ctx context.Context, key string, language language.Tag) *InstanceCustomTextWriteModel {
 	return &InstanceCustomTextWriteModel{
 		CustomTextWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			Key:      key,
 			Language: language,

internal/command/instance_debug_notification_file.go

@@ -12,7 +12,7 @@ import (
 )
 
 func (c *Commands) AddDebugNotificationProviderFile(ctx context.Context, fileSystemProvider *fs.FSConfig) (*domain.ObjectDetails, error) {
-	writeModel := NewInstanceDebugNotificationFileWriteModel()
+	writeModel := NewInstanceDebugNotificationFileWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&writeModel.WriteModel)
 	events, err := c.addDefaultDebugNotificationFile(ctx, instanceAgg, writeModel, fileSystemProvider)
 	if err != nil {
@@ -47,7 +47,7 @@ func (c *Commands) addDefaultDebugNotificationFile(ctx context.Context, instance
 }
 
 func (c *Commands) ChangeDefaultNotificationFile(ctx context.Context, fileSystemProvider *fs.FSConfig) (*domain.ObjectDetails, error) {
-	writeModel := NewInstanceDebugNotificationFileWriteModel()
+	writeModel := NewInstanceDebugNotificationFileWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&writeModel.WriteModel)
 	events, err := c.changeDefaultDebugNotificationProviderFile(ctx, instanceAgg, writeModel, fileSystemProvider)
 	if err != nil {
@@ -87,7 +87,7 @@ func (c *Commands) changeDefaultDebugNotificationProviderFile(ctx context.Contex
 }
 
 func (c *Commands) RemoveDefaultNotificationFile(ctx context.Context) (*domain.ObjectDetails, error) {
-	existingProvider := NewInstanceDebugNotificationFileWriteModel()
+	existingProvider := NewInstanceDebugNotificationFileWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&existingProvider.WriteModel)
 	err := c.defaultDebugNotificationProviderFileWriteModelByID(ctx, existingProvider)
 	if err != nil {

internal/command/instance_debug_notification_file_model.go

@@ -3,10 +3,10 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/settings"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
 
@@ -14,12 +14,12 @@ type InstanceDebugNotificationFileWriteModel struct {
 	DebugNotificationWriteModel
 }
 
-func NewInstanceDebugNotificationFileWriteModel() *InstanceDebugNotificationFileWriteModel {
+func NewInstanceDebugNotificationFileWriteModel(ctx context.Context) *InstanceDebugNotificationFileWriteModel {
 	return &InstanceDebugNotificationFileWriteModel{
 		DebugNotificationWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_debug_notification_file_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -41,7 +42,7 @@ func TestCommandSide_AddDefaultDebugNotificationProviderFile(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDebugNotificationProviderFileAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -67,9 +68,10 @@ func TestCommandSide_AddDefaultDebugNotificationProviderFile(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewDebugNotificationProviderFileAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									true,
 								),
 							),
@@ -78,14 +80,14 @@ func TestCommandSide_AddDefaultDebugNotificationProviderFile(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: true,
 				},
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: domain.IAMID,
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -154,7 +156,7 @@ func TestCommandSide_ChangeDebugNotificationProviderFile(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDebugNotificationProviderFileAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -180,7 +182,7 @@ func TestCommandSide_ChangeDebugNotificationProviderFile(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDebugNotificationProviderFileAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -204,16 +206,18 @@ func TestCommandSide_ChangeDebugNotificationProviderFile(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewDebugNotificationProviderFileAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
 					),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								newDefaultDebugNotificationFileChangedEvent(context.Background(),
 									false),
 							),
@@ -222,7 +226,7 @@ func TestCommandSide_ChangeDebugNotificationProviderFile(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: false,
 					Enabled: false,
@@ -230,7 +234,7 @@ func TestCommandSide_ChangeDebugNotificationProviderFile(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -292,29 +296,31 @@ func TestCommandSide_RemoveDebugNotificationProviderFile(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewDebugNotificationProviderFileAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
 					),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewDebugNotificationProviderFileRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate),
+									&instance.NewAggregate("INSTANCE").Aggregate),
 							),
 						},
 					),
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -339,7 +345,7 @@ func TestCommandSide_RemoveDebugNotificationProviderFile(t *testing.T) {
 }
 func newDefaultDebugNotificationFileChangedEvent(ctx context.Context, compact bool) *instance.DebugNotificationProviderFileChangedEvent {
 	event, _ := instance.NewDebugNotificationProviderFileChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]settings.DebugNotificationProviderChanges{
 			settings.ChangeCompact(compact),
 		},

internal/command/instance_debug_notification_log.go

@@ -12,7 +12,7 @@ import (
 )
 
 func (c *Commands) AddDebugNotificationProviderLog(ctx context.Context, fileSystemProvider *fs.FSConfig) (*domain.ObjectDetails, error) {
-	writeModel := NewInstanceDebugNotificationLogWriteModel()
+	writeModel := NewInstanceDebugNotificationLogWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&writeModel.WriteModel)
 	events, err := c.addDefaultDebugNotificationLog(ctx, instanceAgg, writeModel, fileSystemProvider)
 	if err != nil {
@@ -47,7 +47,7 @@ func (c *Commands) addDefaultDebugNotificationLog(ctx context.Context, instanceA
 }
 
 func (c *Commands) ChangeDefaultNotificationLog(ctx context.Context, fileSystemProvider *fs.FSConfig) (*domain.ObjectDetails, error) {
-	writeModel := NewInstanceDebugNotificationLogWriteModel()
+	writeModel := NewInstanceDebugNotificationLogWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&writeModel.WriteModel)
 	event, err := c.changeDefaultDebugNotificationProviderLog(ctx, instanceAgg, writeModel, fileSystemProvider)
 	if err != nil {
@@ -82,7 +82,7 @@ func (c *Commands) changeDefaultDebugNotificationProviderLog(ctx context.Context
 }
 
 func (c *Commands) RemoveDefaultNotificationLog(ctx context.Context) (*domain.ObjectDetails, error) {
-	existingProvider := NewInstanceDebugNotificationLogWriteModel()
+	existingProvider := NewInstanceDebugNotificationLogWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&existingProvider.WriteModel)
 	err := c.defaultDebugNotificationProviderLogWriteModelByID(ctx, existingProvider)
 	if err != nil {

internal/command/instance_debug_notification_log_model.go

@@ -3,10 +3,10 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/settings"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
 
@@ -14,12 +14,12 @@ type InstanceDebugNotificationLogWriteModel struct {
 	DebugNotificationWriteModel
 }
 
-func NewInstanceDebugNotificationLogWriteModel() *InstanceDebugNotificationLogWriteModel {
+func NewInstanceDebugNotificationLogWriteModel(ctx context.Context) *InstanceDebugNotificationLogWriteModel {
 	return &InstanceDebugNotificationLogWriteModel{
 		DebugNotificationWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_debug_notification_log_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -39,9 +40,10 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -49,7 +51,7 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: true,
 					Enabled: true,
@@ -67,9 +69,10 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									true,
 								),
 							),
@@ -78,14 +81,14 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: true,
 				},
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: domain.IAMID,
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -97,9 +100,10 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									true,
 								),
 							),
@@ -108,7 +112,7 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: true,
 					Enabled: true,
@@ -116,7 +120,7 @@ func TestCommandSide_AddDefaultDebugNotificationProviderLog(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: domain.IAMID,
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -185,7 +189,7 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -209,16 +213,18 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
 					),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								newDefaultDebugNotificationLogChangedEvent(context.Background(),
 									false),
 							),
@@ -227,7 +233,7 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: false,
 					Enabled: false,
@@ -235,7 +241,7 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -247,14 +253,15 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
 					),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								newDefaultDebugNotificationLogChangedEvent(context.Background(),
 									false),
 							),
@@ -263,7 +270,7 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &fs.FSConfig{
 					Compact: false,
 					Enabled: true,
@@ -271,7 +278,7 @@ func TestCommandSide_ChangeDebugNotificationProviderLog(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -333,29 +340,31 @@ func TestCommandSide_RemoveDebugNotificationProviderLog(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewDebugNotificationProviderLogAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
 					),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewDebugNotificationProviderLogRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate),
+									&instance.NewAggregate("INSTANCE").Aggregate),
 							),
 						},
 					),
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -380,7 +389,7 @@ func TestCommandSide_RemoveDebugNotificationProviderLog(t *testing.T) {
 }
 func newDefaultDebugNotificationLogChangedEvent(ctx context.Context, compact bool) *instance.DebugNotificationProviderLogChangedEvent {
 	event, _ := instance.NewDebugNotificationProviderLogChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]settings.DebugNotificationProviderChanges{
 			settings.ChangeCompact(compact),
 		},

internal/command/instance_domain.go

@@ -0,0 +1,98 @@
+package command
+
+import (
+	"context"
+	"strings"
+
+	"github.com/caos/zitadel/internal/api/authz"
+	"github.com/caos/zitadel/internal/command/v2/preparation"
+	"github.com/caos/zitadel/internal/repository/instance"
+
+	"github.com/caos/zitadel/internal/domain"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore"
+)
+
+func (c *Commands) AddInstanceDomain(ctx context.Context, instanceDomain string) (*domain.ObjectDetails, error) {
+	instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID())
+	validation := c.addInstanceDomain(instanceAgg, instanceDomain, false)
+	cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validation)
+	if err != nil {
+		return nil, err
+	}
+	events, err := c.eventstore.Push(ctx, cmds...)
+	if err != nil {
+		return nil, err
+	}
+	return &domain.ObjectDetails{
+		Sequence:      events[len(events)-1].Sequence(),
+		EventDate:     events[len(events)-1].CreationDate(),
+		ResourceOwner: events[len(events)-1].Aggregate().InstanceID,
+	}, nil
+}
+
+func (c *Commands) RemoveInstanceDomain(ctx context.Context, instanceDomain string) (*domain.ObjectDetails, error) {
+	instanceAgg := instance.NewAggregate(authz.GetInstance(ctx).InstanceID())
+	validation := c.removeInstanceDomain(instanceAgg, instanceDomain)
+	cmds, err := preparation.PrepareCommands(ctx, c.eventstore.Filter, validation)
+	if err != nil {
+		return nil, err
+	}
+	events, err := c.eventstore.Push(ctx, cmds...)
+	if err != nil {
+		return nil, err
+	}
+	return &domain.ObjectDetails{
+		Sequence:      events[len(events)-1].Sequence(),
+		EventDate:     events[len(events)-1].CreationDate(),
+		ResourceOwner: events[len(events)-1].Aggregate().InstanceID,
+	}, nil
+}
+
+func (c *Commands) addInstanceDomain(a *instance.Aggregate, instanceDomain string, generated bool) preparation.Validation {
+	return func() (preparation.CreateCommands, error) {
+		if instanceDomain = strings.TrimSpace(instanceDomain); instanceDomain == "" {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-28nlD", "Errors.Invalid.Argument")
+		}
+		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
+			domainWriteModel, err := c.getInstanceDomainWriteModel(ctx, instanceDomain)
+			if err != nil {
+				return nil, err
+			}
+			if domainWriteModel.State == domain.InstanceDomainStateActive {
+				return nil, caos_errs.ThrowAlreadyExists(nil, "INST-i2nl", "Errors.Instance.Domain.AlreadyExists")
+			}
+			return []eventstore.Command{instance.NewDomainAddedEvent(ctx, &a.Aggregate, instanceDomain, generated)}, nil
+		}, nil
+	}
+}
+
+func (c *Commands) removeInstanceDomain(a *instance.Aggregate, instanceDomain string) preparation.Validation {
+	return func() (preparation.CreateCommands, error) {
+		if instanceDomain = strings.TrimSpace(instanceDomain); instanceDomain == "" {
+			return nil, caos_errs.ThrowInvalidArgument(nil, "INST-39nls", "Errors.Invalid.Argument")
+		}
+		return func(ctx context.Context, filter preparation.FilterToQueryReducer) ([]eventstore.Command, error) {
+			domainWriteModel, err := c.getInstanceDomainWriteModel(ctx, instanceDomain)
+			if err != nil {
+				return nil, err
+			}
+			if domainWriteModel.State != domain.InstanceDomainStateActive {
+				return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-8ls9f", "Errors.Instance.Domain.NotFound")
+			}
+			if domainWriteModel.Generated {
+				return nil, caos_errs.ThrowPreconditionFailed(nil, "INSTANCE-9hn3n", "Errors.Instance.Domain.GeneratedNotRemovable")
+			}
+			return []eventstore.Command{instance.NewDomainRemovedEvent(ctx, &a.Aggregate, instanceDomain)}, nil
+		}, nil
+	}
+}
+
+func (c *Commands) getInstanceDomainWriteModel(ctx context.Context, domain string) (*InstanceDomainWriteModel, error) {
+	domainWriteModel := NewInstanceDomainWriteModel(ctx, domain)
+	err := c.eventstore.FilterToQueryReducer(ctx, domainWriteModel)
+	if err != nil {
+		return nil, err
+	}
+	return domainWriteModel, nil
+}

internal/command/instance_domain_model.go

@@ -0,0 +1,71 @@
+package command
+
+import (
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
+	"github.com/caos/zitadel/internal/domain"
+	"github.com/caos/zitadel/internal/eventstore"
+	"github.com/caos/zitadel/internal/repository/instance"
+)
+
+type InstanceDomainWriteModel struct {
+	eventstore.WriteModel
+
+	Domain    string
+	Generated bool
+	State     domain.InstanceDomainState
+}
+
+func NewInstanceDomainWriteModel(ctx context.Context, instanceDomain string) *InstanceDomainWriteModel {
+	return &InstanceDomainWriteModel{
+		WriteModel: eventstore.WriteModel{
+			AggregateID:   authz.GetInstance(ctx).InstanceID(),
+			ResourceOwner: authz.GetInstance(ctx).InstanceID(),
+		},
+		Domain: instanceDomain,
+	}
+}
+
+func (wm *InstanceDomainWriteModel) AppendEvents(events ...eventstore.Event) {
+	for _, event := range events {
+		switch e := event.(type) {
+		case *instance.DomainAddedEvent:
+			if e.Domain != wm.Domain {
+				continue
+			}
+			wm.WriteModel.AppendEvents(e)
+		case *instance.DomainRemovedEvent:
+			if e.Domain != wm.Domain {
+				continue
+			}
+			wm.WriteModel.AppendEvents(e)
+		}
+	}
+}
+
+func (wm *InstanceDomainWriteModel) Reduce() error {
+	for _, event := range wm.Events {
+		switch e := event.(type) {
+		case *instance.DomainAddedEvent:
+			wm.Domain = e.Domain
+			wm.Generated = e.Generated
+			wm.State = domain.InstanceDomainStateActive
+		case *instance.DomainRemovedEvent:
+			wm.State = domain.InstanceDomainStateRemoved
+		}
+	}
+	return nil
+}
+
+func (wm *InstanceDomainWriteModel) Query() *eventstore.SearchQueryBuilder {
+	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
+		ResourceOwner(wm.ResourceOwner).
+		AddQuery().
+		AggregateTypes(instance.AggregateType).
+		AggregateIDs(wm.AggregateID).
+		EventTypes(
+			instance.InstanceDomainAddedEventType,
+			instance.InstanceDomainRemovedEventType).
+		Builder()
+}

internal/command/instance_domain_test.go

@@ -0,0 +1,253 @@
+package command
+
+import (
+	"context"
+	"testing"
+
+	"github.com/caos/zitadel/internal/api/authz"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/caos/zitadel/internal/domain"
+	caos_errs "github.com/caos/zitadel/internal/errors"
+	"github.com/caos/zitadel/internal/eventstore"
+	"github.com/caos/zitadel/internal/eventstore/repository"
+	"github.com/caos/zitadel/internal/repository/instance"
+)
+
+func TestCommandSide_AddInstanceDomain(t *testing.T) {
+	type fields struct {
+		eventstore *eventstore.Eventstore
+	}
+	type args struct {
+		ctx    context.Context
+		domain string
+	}
+	type res struct {
+		want *domain.ObjectDetails
+		err  func(error) bool
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		res    res
+	}{
+		{
+			name: "invalid domain, error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+				),
+			},
+			args: args{
+				ctx:    context.Background(),
+				domain: "",
+			},
+			res: res{
+				err: caos_errs.IsErrorInvalidArgument,
+			},
+		},
+		{
+			name: "domain already exists, precondition error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:    context.Background(),
+				domain: "domain.ch",
+			},
+			res: res{
+				err: caos_errs.IsErrorAlreadyExists,
+			},
+		},
+		{
+			name: "domain add, ok",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(),
+					expectPush(
+						[]*repository.Event{
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
+								instance.NewDomainAddedEvent(context.Background(),
+									&instance.NewAggregate("INSTANCE").Aggregate,
+									"domain.ch",
+									false,
+								)),
+						},
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", instance.NewAddInstanceDomainUniqueConstraint("domain.ch")),
+					),
+				),
+			},
+			args: args{
+				ctx:    authz.WithInstanceID(context.Background(), "INSTANCE"),
+				domain: "domain.ch",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &Commands{
+				eventstore: tt.fields.eventstore,
+			}
+			got, err := r.AddInstanceDomain(tt.args.ctx, tt.args.domain)
+			if tt.res.err == nil {
+				assert.NoError(t, err)
+			}
+			if tt.res.err != nil && !tt.res.err(err) {
+				t.Errorf("got wrong err: %v ", err)
+			}
+			if tt.res.err == nil {
+				assert.Equal(t, tt.res.want, got)
+			}
+		})
+	}
+}
+
+func TestCommandSide_RemoveInstanceDomain(t *testing.T) {
+	type fields struct {
+		eventstore *eventstore.Eventstore
+	}
+	type args struct {
+		ctx    context.Context
+		domain string
+	}
+	type res struct {
+		want *domain.ObjectDetails
+		err  func(error) bool
+	}
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		res    res
+	}{
+		{
+			name: "invalid domain, error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+				),
+			},
+			args: args{
+				ctx:    context.Background(),
+				domain: "",
+			},
+			res: res{
+				err: caos_errs.IsErrorInvalidArgument,
+			},
+		},
+		{
+			name: "domain not exists, precondition error",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(),
+				),
+			},
+			args: args{
+				ctx:    context.Background(),
+				domain: "domain.ch",
+			},
+			res: res{
+				err: caos_errs.IsNotFound,
+			},
+		},
+		{
+			name: "remove domain, ok",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								false,
+							),
+						),
+					),
+					expectPush(
+						[]*repository.Event{
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
+								instance.NewDomainRemovedEvent(context.Background(),
+									&instance.NewAggregate("INSTANCE").Aggregate,
+									"domain.ch",
+								)),
+						},
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", instance.NewRemoveInstanceDomainUniqueConstraint("domain.ch")),
+					),
+				),
+			},
+			args: args{
+				ctx:    authz.WithInstanceID(context.Background(), "INSTANCE"),
+				domain: "domain.ch",
+			},
+			res: res{
+				want: &domain.ObjectDetails{
+					ResourceOwner: "INSTANCE",
+				},
+			},
+		},
+		{
+			name: "remove generated domain, precondition failed",
+			fields: fields{
+				eventstore: eventstoreExpect(
+					t,
+					expectFilter(
+						eventFromEventPusher(
+							instance.NewDomainAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
+								"domain.ch",
+								true,
+							),
+						),
+					),
+				),
+			},
+			args: args{
+				ctx:    context.Background(),
+				domain: "domain.ch",
+			},
+			res: res{
+				err: caos_errs.IsPreconditionFailed,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &Commands{
+				eventstore: tt.fields.eventstore,
+			}
+			got, err := r.RemoveInstanceDomain(tt.args.ctx, tt.args.domain)
+			if tt.res.err == nil {
+				assert.NoError(t, err)
+			}
+			if tt.res.err != nil && !tt.res.err(err) {
+				t.Errorf("got wrong err: %v ", err)
+			}
+			if tt.res.err == nil {
+				assert.Equal(t, tt.res.want, got)
+			}
+		})
+	}
+}

internal/command/instance_features.go

@@ -10,7 +10,7 @@ import (
 )
 
 func (c *Commands) SetDefaultFeatures(ctx context.Context, features *domain.Features) (*domain.ObjectDetails, error) {
-	existingFeatures := NewInstanceFeaturesWriteModel()
+	existingFeatures := NewInstanceFeaturesWriteModel(ctx)
 	setEvent, err := c.setDefaultFeatures(ctx, existingFeatures, features)
 	if err != nil {
 		return nil, err
@@ -65,7 +65,7 @@ func (c *Commands) setDefaultFeatures(ctx context.Context, existingFeatures *Ins
 }
 
 func (c *Commands) getDefaultFeatures(ctx context.Context) (*domain.Features, error) {
-	existingFeatures := NewInstanceFeaturesWriteModel()
+	existingFeatures := NewInstanceFeaturesWriteModel(ctx)
 	err := c.eventstore.FilterToQueryReducer(ctx, existingFeatures)
 	if err != nil {
 		return nil, err

internal/command/instance_features_model.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/features"
@@ -14,12 +15,12 @@ type InstanceFeaturesWriteModel struct {
 	FeaturesWriteModel
 }
 
-func NewInstanceFeaturesWriteModel() *InstanceFeaturesWriteModel {
+func NewInstanceFeaturesWriteModel(ctx context.Context) *InstanceFeaturesWriteModel {
 	return &InstanceFeaturesWriteModel{
 		FeaturesWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_idp_config.go

@@ -3,6 +3,7 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -21,7 +22,7 @@ func (c *Commands) AddDefaultIDPConfig(ctx context.Context, config *domain.IDPCo
 	if err != nil {
 		return nil, err
 	}
-	addedConfig := NewInstanceIDPConfigWriteModel(idpConfigID)
+	addedConfig := NewInstanceIDPConfigWriteModel(ctx, idpConfigID)
 
 	instanceAgg := InstanceAggregateFromWriteModel(&addedConfig.WriteModel)
 	events := []eventstore.Command{
@@ -159,7 +160,7 @@ func (c *Commands) RemoveDefaultIDPConfig(ctx context.Context, idpID string, idp
 	}
 
 	for _, idpProvider := range idpProviders {
-		if idpProvider.AggregateID == domain.IAMID {
+		if idpProvider.AggregateID == authz.GetInstance(ctx).InstanceID() {
 			userEvents := c.removeIDPProviderFromDefaultLoginPolicy(ctx, instanceAgg, idpProvider, true, externalIDPs...)
 			events = append(events, userEvents...)
 		}
@@ -194,7 +195,7 @@ func (c *Commands) isntanceIDPConfigWriteModelByID(ctx context.Context, idpID st
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceIDPConfigWriteModel(idpID)
+	writeModel := NewInstanceIDPConfigWriteModel(ctx, idpID)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_idp_config_model.go

@@ -3,6 +3,7 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -14,12 +15,12 @@ type InstanceIDPConfigWriteModel struct {
 	IDPConfigWriteModel
 }
 
-func NewInstanceIDPConfigWriteModel(configID string) *InstanceIDPConfigWriteModel {
+func NewInstanceIDPConfigWriteModel(ctx context.Context, configID string) *InstanceIDPConfigWriteModel {
 	return &InstanceIDPConfigWriteModel{
 		IDPConfigWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			ConfigID: configID,
 		},

internal/command/instance_idp_config_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 
@@ -61,9 +62,10 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 					t,
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewIDPConfigAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1",
 									"name1",
 									domain.IDPConfigTypeOIDC,
@@ -71,9 +73,10 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 									true,
 								),
 							),
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewIDPOIDCConfigAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"clientid1",
 									"config1",
 									"issuer",
@@ -91,14 +94,14 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 								),
 							),
 						},
-						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("name1", "IAM")),
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", idpconfig.NewAddIDPConfigNameUniqueConstraint("name1", "INSTANCE")),
 					),
 				),
 				idGenerator:  id_mock.NewIDGeneratorExpectIDs(t, "config1"),
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				config: &domain.IDPConfig{
 					Name:         "name1",
 					StylingType:  domain.IDPConfigStylingTypeGoogle,
@@ -118,8 +121,9 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 			res: res{
 				want: &domain.IDPConfig{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					IDPConfigID:  "config1",
 					Name:         "name1",
@@ -136,9 +140,10 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 					t,
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewIDPConfigAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1",
 									"name1",
 									domain.IDPConfigTypeOIDC,
@@ -146,9 +151,10 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 									false,
 								),
 							),
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewIDPJWTConfigAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1",
 									"jwt-endpoint",
 									"issuer",
@@ -157,13 +163,13 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 								),
 							),
 						},
-						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("name1", "IAM")),
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", idpconfig.NewAddIDPConfigNameUniqueConstraint("name1", "INSTANCE")),
 					),
 				),
 				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "config1"),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				config: &domain.IDPConfig{
 					Name:        "name1",
 					StylingType: domain.IDPConfigStylingTypeGoogle,
@@ -178,8 +184,9 @@ func TestCommandSide_AddDefaultIDPConfig(t *testing.T) {
 			res: res{
 				want: &domain.IDPConfig{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					IDPConfigID: "config1",
 					Name:        "name1",
@@ -269,7 +276,7 @@ func TestCommandSide_ChangeDefaultIDPConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeOIDC,
@@ -279,7 +286,7 @@ func TestCommandSide_ChangeDefaultIDPConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPOIDCConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"clientid1",
 								"config1",
 								"issuer",
@@ -303,8 +310,8 @@ func TestCommandSide_ChangeDefaultIDPConfig(t *testing.T) {
 								newDefaultIDPConfigChangedEvent(context.Background(), "config1", "name1", "name2", domain.IDPConfigStylingTypeUnspecified, false),
 							),
 						},
-						uniqueConstraintsFromEventConstraint(idpconfig.NewRemoveIDPConfigNameUniqueConstraint("name1", "IAM")),
-						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("name2", "IAM")),
+						uniqueConstraintsFromEventConstraint(idpconfig.NewRemoveIDPConfigNameUniqueConstraint("name1", "INSTANCE")),
+						uniqueConstraintsFromEventConstraint(idpconfig.NewAddIDPConfigNameUniqueConstraint("name2", "INSTANCE")),
 					),
 				),
 			},
@@ -320,8 +327,8 @@ func TestCommandSide_ChangeDefaultIDPConfig(t *testing.T) {
 			res: res{
 				want: &domain.IDPConfig{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					IDPConfigID:  "config1",
 					Name:         "name2",
@@ -353,7 +360,7 @@ func TestCommandSide_ChangeDefaultIDPConfig(t *testing.T) {
 
 func newDefaultIDPConfigChangedEvent(ctx context.Context, configID, oldName, newName string, stylingType domain.IDPConfigStylingType, autoRegister bool) *instance.IDPConfigChangedEvent {
 	event, _ := instance.NewIDPConfigChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		configID,
 		oldName,
 		[]idpconfig.IDPConfigChanges{

internal/command/instance_idp_jwt_config.go

@@ -11,7 +11,7 @@ func (c *Commands) ChangeDefaultIDPJWTConfig(ctx context.Context, config *domain
 	if config.IDPConfigID == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-m9322", "Errors.IDMissing")
 	}
-	existingConfig := NewInstanceIDPJWTConfigWriteModel(config.IDPConfigID)
+	existingConfig := NewInstanceIDPJWTConfigWriteModel(ctx, config.IDPConfigID)
 	err := c.eventstore.FilterToQueryReducer(ctx, existingConfig)
 	if err != nil {
 		return nil, err

internal/command/instance_idp_jwt_config_model.go

@@ -3,9 +3,9 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/idpconfig"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
@@ -14,12 +14,12 @@ type InstanceIDPJWTConfigWriteModel struct {
 	JWTConfigWriteModel
 }
 
-func NewInstanceIDPJWTConfigWriteModel(idpConfigID string) *InstanceIDPJWTConfigWriteModel {
+func NewInstanceIDPJWTConfigWriteModel(ctx context.Context, idpConfigID string) *InstanceIDPJWTConfigWriteModel {
 	return &InstanceIDPJWTConfigWriteModel{
 		JWTConfigWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			IDPConfigID: idpConfigID,
 		},

internal/command/instance_idp_jwt_config_test.go

@@ -24,8 +24,9 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 	}
 	type (
 		args struct {
-			ctx    context.Context
-			config *domain.JWTIDPConfig
+			ctx        context.Context
+			instanceID string
+			config     *domain.JWTIDPConfig
 		}
 	)
 	type res struct {
@@ -46,8 +47,9 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx:    context.Background(),
-				config: &domain.JWTIDPConfig{},
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				config:     &domain.JWTIDPConfig{},
 			},
 			res: res{
 				err: caos_errs.IsErrorInvalidArgument,
@@ -62,7 +64,8 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.JWTIDPConfig{
 					IDPConfigID: "config1",
 				},
@@ -79,7 +82,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeJWT,
@@ -89,7 +92,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPJWTConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"jwt-endpoint",
 								"issuer",
@@ -99,7 +102,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPConfigRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name",
 							),
@@ -108,7 +111,8 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.JWTIDPConfig{
 					IDPConfigID: "config1",
 				},
@@ -125,7 +129,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeJWT,
@@ -135,7 +139,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPJWTConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"jwt-endpoint",
 								"issuer",
@@ -148,7 +152,8 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.JWTIDPConfig{
 					IDPConfigID:  "config1",
 					JWTEndpoint:  "jwt-endpoint",
@@ -169,7 +174,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeJWT,
@@ -179,7 +184,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPJWTConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"jwt-endpoint",
 								"issuer",
@@ -205,7 +210,8 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.JWTIDPConfig{
 					IDPConfigID:  "config1",
 					JWTEndpoint:  "jwt-endpoint-changed",
@@ -217,8 +223,8 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 			res: res{
 				want: &domain.JWTIDPConfig{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					IDPConfigID:  "config1",
 					JWTEndpoint:  "jwt-endpoint-changed",
@@ -251,7 +257,7 @@ func TestCommandSide_ChangeDefaultIDPJWTConfig(t *testing.T) {
 
 func newDefaultIDPJWTConfigChangedEvent(ctx context.Context, configID, jwtEndpoint, issuer, keysEndpoint, headerName string) *instance.IDPJWTConfigChangedEvent {
 	event, _ := instance.NewIDPJWTConfigChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		configID,
 		[]idpconfig.JWTConfigChanges{
 			idpconfig.ChangeJWTEndpoint(jwtEndpoint),

internal/command/instance_idp_oidc_config.go

@@ -11,7 +11,7 @@ func (c *Commands) ChangeDefaultIDPOIDCConfig(ctx context.Context, config *domai
 	if config.IDPConfigID == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-9djf8", "Errors.IDMissing")
 	}
-	existingConfig := NewInstanceIDPOIDCConfigWriteModel(config.IDPConfigID)
+	existingConfig := NewInstanceIDPOIDCConfigWriteModel(ctx, config.IDPConfigID)
 	err := c.eventstore.FilterToQueryReducer(ctx, existingConfig)
 	if err != nil {
 		return nil, err

internal/command/instance_idp_oidc_config_model.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"reflect"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
 	"github.com/caos/zitadel/internal/crypto"
@@ -16,12 +17,12 @@ type InstanceIDPOIDCConfigWriteModel struct {
 	OIDCConfigWriteModel
 }
 
-func NewInstanceIDPOIDCConfigWriteModel(idpConfigID string) *InstanceIDPOIDCConfigWriteModel {
+func NewInstanceIDPOIDCConfigWriteModel(ctx context.Context, idpConfigID string) *InstanceIDPOIDCConfigWriteModel {
 	return &InstanceIDPOIDCConfigWriteModel{
 		OIDCConfigWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			IDPConfigID: idpConfigID,
 		},

internal/command/instance_idp_oidc_config_test.go

@@ -24,8 +24,9 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 	}
 	type (
 		args struct {
-			ctx    context.Context
-			config *domain.OIDCIDPConfig
+			ctx        context.Context
+			instanceID string
+			config     *domain.OIDCIDPConfig
 		}
 	)
 	type res struct {
@@ -46,8 +47,9 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx:    context.Background(),
-				config: &domain.OIDCIDPConfig{},
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				config:     &domain.OIDCIDPConfig{},
 			},
 			res: res{
 				err: caos_errs.IsErrorInvalidArgument,
@@ -62,7 +64,8 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.OIDCIDPConfig{
 					IDPConfigID: "config1",
 				},
@@ -79,7 +82,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeOIDC,
@@ -89,7 +92,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPOIDCConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"clientid1",
 								"config1",
 								"issuer",
@@ -108,7 +111,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPConfigRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name",
 							),
@@ -117,7 +120,8 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.OIDCIDPConfig{
 					IDPConfigID: "config1",
 				},
@@ -134,7 +138,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeOIDC,
@@ -144,7 +148,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPOIDCConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"clientid1",
 								"config1",
 								"issuer",
@@ -166,7 +170,8 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.OIDCIDPConfig{
 					IDPConfigID:           "config1",
 					ClientID:              "clientid1",
@@ -190,7 +195,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name1",
 								domain.IDPConfigTypeOIDC,
@@ -200,7 +205,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewIDPOIDCConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"clientid1",
 								"config1",
 								"issuer",
@@ -244,7 +249,8 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 				secretCrypto: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				config: &domain.OIDCIDPConfig{
 					IDPConfigID:           "config1",
 					ClientID:              "clientid-changed",
@@ -260,8 +266,8 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 			res: res{
 				want: &domain.OIDCIDPConfig{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					IDPConfigID:           "config1",
 					ClientID:              "clientid-changed",
@@ -297,7 +303,7 @@ func TestCommandSide_ChangeDefaultIDPOIDCConfig(t *testing.T) {
 
 func newDefaultIDPOIDCConfigChangedEvent(ctx context.Context, configID, clientID, issuer, authorizationEndpoint, tokenEndpoint string, secret *crypto.CryptoValue, displayMapping, usernameMapping domain.OIDCMappingField, scopes []string) *instance.IDPOIDCConfigChangedEvent {
 	event, _ := instance.NewIDPOIDCConfigChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		configID,
 		[]idpconfig.OIDCConfigChanges{
 			idpconfig.ChangeClientID(clientID),

internal/command/instance_member.go

@@ -17,7 +17,7 @@ func (c *Commands) AddInstanceMember(ctx context.Context, member *domain.Member)
 	if member.UserID == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-Mf83b", "Errors.IAM.MemberInvalid")
 	}
-	addedMember := NewInstanceMemberWriteModel(member.UserID)
+	addedMember := NewInstanceMemberWriteModel(ctx, member.UserID)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedMember.MemberWriteModel.WriteModel)
 	err := c.checkUserExists(ctx, addedMember.UserID, "")
 	if err != nil {
@@ -128,7 +128,7 @@ func (c *Commands) instanceMemberWriteModelByID(ctx context.Context, userID stri
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceMemberWriteModel(userID)
+	writeModel := NewInstanceMemberWriteModel(ctx, userID)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_member_model.go

@@ -1,7 +1,9 @@
 package command
 
 import (
-	"github.com/caos/zitadel/internal/domain"
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
@@ -10,12 +12,12 @@ type InstanceMemberWriteModel struct {
 	MemberWriteModel
 }
 
-func NewInstanceMemberWriteModel(userID string) *InstanceMemberWriteModel {
+func NewInstanceMemberWriteModel(ctx context.Context, userID string) *InstanceMemberWriteModel {
 	return &InstanceMemberWriteModel{
 		MemberWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			UserID: userID,
 		},

internal/command/instance_member_test.go

@@ -2,6 +2,8 @@ package command
 
 import (
 	"context"
+	"testing"
+
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
@@ -13,7 +15,6 @@ import (
 	"github.com/caos/zitadel/internal/repository/user"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/text/language"
-	"testing"
 )
 
 func TestCommandSide_AddIAMMember(t *testing.T) {
@@ -127,7 +128,7 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMemberAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 							),
 						),
@@ -174,13 +175,13 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 					expectFilter(),
 					expectPushFailed(caos_errs.ThrowAlreadyExists(nil, "ERROR", "internal"),
 						[]*repository.Event{
-							eventFromEventPusher(instance.NewMemberAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+							eventFromEventPusherWithInstanceID("INSTANCE", instance.NewMemberAddedEvent(context.Background(),
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
 							)),
 						},
-						uniqueConstraintsFromEventConstraint(member.NewAddMemberUniqueConstraint("IAM", "user1")),
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", member.NewAddMemberUniqueConstraint("INSTANCE", "user1")),
 					),
 				),
 				zitadelRoles: []authz.RoleMapping{
@@ -190,7 +191,7 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 				},
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				member: &domain.Member{
 					UserID: "user1",
 					Roles:  []string{"IAM_OWNER"},
@@ -206,7 +207,8 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							user.NewHumanAddedEvent(context.Background(),
 								&user.NewAggregate("user1", "org1").Aggregate,
 								"username1",
@@ -224,13 +226,15 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(instance.NewMemberAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
-								"user1",
-								[]string{"IAM_OWNER"}...,
-							)),
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
+								instance.NewMemberAddedEvent(context.Background(),
+									&instance.NewAggregate("INSTANCE").Aggregate,
+									"user1",
+									[]string{"IAM_OWNER"}...,
+								)),
 						},
-						uniqueConstraintsFromEventConstraint(member.NewAddMemberUniqueConstraint("IAM", "user1")),
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", member.NewAddMemberUniqueConstraint("INSTANCE", "user1")),
 					),
 				),
 				zitadelRoles: []authz.RoleMapping{
@@ -240,7 +244,7 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 				},
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				member: &domain.Member{
 					UserID: "user1",
 					Roles:  []string{"IAM_OWNER"},
@@ -249,8 +253,9 @@ func TestCommandSide_AddIAMMember(t *testing.T) {
 			res: res{
 				want: &domain.Member{
 					ObjectRoot: models.ObjectRoot{
-						ResourceOwner: "IAM",
-						AggregateID:   "IAM",
+						InstanceID:    "INSTANCE",
+						ResourceOwner: "INSTANCE",
+						AggregateID:   "INSTANCE",
 					},
 					UserID: "user1",
 					Roles:  []string{"IAM_OWNER"},
@@ -284,8 +289,9 @@ func TestCommandSide_ChangeIAMMember(t *testing.T) {
 		zitadelRoles []authz.RoleMapping
 	}
 	type args struct {
-		ctx    context.Context
-		member *domain.Member
+		ctx        context.Context
+		instanceID string
+		member     *domain.Member
 	}
 	type res struct {
 		want *domain.Member
@@ -362,7 +368,7 @@ func TestCommandSide_ChangeIAMMember(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMemberAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
 							),
@@ -394,7 +400,7 @@ func TestCommandSide_ChangeIAMMember(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMemberAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
 							),
@@ -403,7 +409,7 @@ func TestCommandSide_ChangeIAMMember(t *testing.T) {
 					expectPush(
 						[]*repository.Event{
 							eventFromEventPusher(instance.NewMemberChangedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER", "IAM_OWNER_VIEWER"}...,
 							)),
@@ -429,8 +435,8 @@ func TestCommandSide_ChangeIAMMember(t *testing.T) {
 			res: res{
 				want: &domain.Member{
 					ObjectRoot: models.ObjectRoot{
-						ResourceOwner: "IAM",
-						AggregateID:   "IAM",
+						ResourceOwner: "INSTANCE",
+						AggregateID:   "INSTANCE",
 					},
 					UserID: "user1",
 					Roles:  []string{"IAM_OWNER", "IAM_OWNER_VIEWER"},
@@ -463,8 +469,9 @@ func TestCommandSide_RemoveIAMMember(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx    context.Context
-		userID string
+		ctx        context.Context
+		instanceID string
+		userID     string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -515,7 +522,7 @@ func TestCommandSide_RemoveIAMMember(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMemberAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 								[]string{"IAM_OWNER"}...,
 							),
@@ -524,11 +531,11 @@ func TestCommandSide_RemoveIAMMember(t *testing.T) {
 					expectPush(
 						[]*repository.Event{
 							eventFromEventPusher(instance.NewMemberRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"user1",
 							)),
 						},
-						uniqueConstraintsFromEventConstraint(member.NewRemoveMemberUniqueConstraint("IAM", "user1")),
+						uniqueConstraintsFromEventConstraint(member.NewRemoveMemberUniqueConstraint("INSTANCE", "user1")),
 					),
 				),
 			},
@@ -538,7 +545,7 @@ func TestCommandSide_RemoveIAMMember(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},

internal/command/instance_model.go

@@ -1,15 +1,20 @@
 package command
 
 import (
+	"golang.org/x/text/language"
+
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
-	"golang.org/x/text/language"
 )
 
 type InstanceWriteModel struct {
 	eventstore.WriteModel
 
+	Name            string
+	State           domain.InstanceState
+	GeneratedDomain string
+
 	SetUpStarted domain.Step
 	SetUpDone    domain.Step
 
@@ -18,11 +23,11 @@ type InstanceWriteModel struct {
 	DefaultLanguage language.Tag
 }
 
-func NewInstanceWriteModel() *InstanceWriteModel {
+func NewInstanceWriteModel(instanceID string) *InstanceWriteModel {
 	return &InstanceWriteModel{
 		WriteModel: eventstore.WriteModel{
-			AggregateID:   domain.IAMID,
-			ResourceOwner: domain.IAMID,
+			AggregateID:   instanceID,
+			ResourceOwner: instanceID,
 		},
 	}
 }
@@ -30,6 +35,18 @@ func NewInstanceWriteModel() *InstanceWriteModel {
 func (wm *InstanceWriteModel) Reduce() error {
 	for _, event := range wm.Events {
 		switch e := event.(type) {
+		case *instance.InstanceAddedEvent:
+			wm.Name = e.Name
+			wm.State = domain.InstanceStateActive
+		case *instance.InstanceChangedEvent:
+			wm.Name = e.Name
+		case *instance.InstanceRemovedEvent:
+			wm.State = domain.InstanceStateRemoved
+		case *instance.DomainAddedEvent:
+			if !e.Generated {
+				continue
+			}
+			wm.GeneratedDomain = e.Domain
 		case *instance.ProjectSetEvent:
 			wm.ProjectID = e.ProjectID
 		case *instance.GlobalOrgSetEvent:
@@ -54,6 +71,11 @@ func (wm *InstanceWriteModel) Query() *eventstore.SearchQueryBuilder {
 		AggregateTypes(instance.AggregateType).
 		AggregateIDs(wm.AggregateID).
 		EventTypes(
+			instance.InstanceAddedEventType,
+			instance.InstanceChangedEventType,
+			instance.InstanceRemovedEventType,
+			instance.InstanceDomainAddedEventType,
+			instance.InstanceDomainRemovedEventType,
 			instance.ProjectSetEventType,
 			instance.GlobalOrgSetEventType,
 			instance.DefaultLanguageSetEventType,

internal/command/instance_oidc_settings.go

@@ -69,7 +69,7 @@ func (c *Commands) ChangeOIDCSettings(ctx context.Context, settings *domain.OIDC
 }
 
 func (c *Commands) getOIDCSettings(ctx context.Context) (_ *InstanceOIDCSettingsWriteModel, err error) {
-	writeModel := NewInstanceOIDCSettingsWriteModel()
+	writeModel := NewInstanceOIDCSettingsWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_oidc_settings_model.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
@@ -19,11 +20,11 @@ type InstanceOIDCSettingsWriteModel struct {
 	State                      domain.OIDCSettingsState
 }
 
-func NewInstanceOIDCSettingsWriteModel() *InstanceOIDCSettingsWriteModel {
+func NewInstanceOIDCSettingsWriteModel(ctx context.Context) *InstanceOIDCSettingsWriteModel {
 	return &InstanceOIDCSettingsWriteModel{
 		WriteModel: eventstore.WriteModel{
-			AggregateID:   domain.IAMID,
-			ResourceOwner: domain.IAMID,
+			AggregateID:   authz.GetInstance(ctx).InstanceID(),
+			ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 		},
 	}
 }

internal/command/instance_oidc_settings_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -40,7 +41,7 @@ func TestCommandSide_AddOIDCConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewOIDCSettingsAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								time.Hour*1,
 								time.Hour*1,
 								time.Hour*1,
@@ -71,21 +72,23 @@ func TestCommandSide_AddOIDCConfig(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(instance.NewOIDCSettingsAddedEvent(
-								context.Background(),
-								&instance.NewAggregate().Aggregate,
-								time.Hour*1,
-								time.Hour*1,
-								time.Hour*1,
-								time.Hour*1,
-							),
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
+								instance.NewOIDCSettingsAddedEvent(
+									context.Background(),
+									&instance.NewAggregate("INSTANCE").Aggregate,
+									time.Hour*1,
+									time.Hour*1,
+									time.Hour*1,
+									time.Hour*1,
+								),
 							),
 						},
 					),
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				oidcConfig: &domain.OIDCSettings{
 					AccessTokenLifetime:        1 * time.Hour,
 					IdTokenLifetime:            1 * time.Hour,
@@ -95,7 +98,7 @@ func TestCommandSide_AddOIDCConfig(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -161,7 +164,7 @@ func TestCommandSide_ChangeOIDCConfig(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewOIDCSettingsAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								time.Hour*1,
 								time.Hour*1,
 								time.Hour*1,
@@ -193,7 +196,7 @@ func TestCommandSide_ChangeOIDCConfig(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewOIDCSettingsAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								time.Hour*1,
 								time.Hour*1,
 								time.Hour*1,
@@ -225,7 +228,7 @@ func TestCommandSide_ChangeOIDCConfig(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -257,7 +260,7 @@ func newOIDCConfigChangedEvent(ctx context.Context, accessTokenLifetime, idToken
 		instance.ChangeOIDCSettingsRefreshTokenExpiration(refreshTokenExpiration),
 	}
 	event, _ := instance.NewOIDCSettingsChangeEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		changes,
 	)
 	return event

internal/command/instance_policy_domain.go

@@ -11,7 +11,7 @@ import (
 )
 
 func (c *Commands) AddDefaultDomainPolicy(ctx context.Context, policy *domain.DomainPolicy) (*domain.DomainPolicy, error) {
-	addedPolicy := NewInstanceDomainPolicyWriteModel()
+	addedPolicy := NewInstanceDomainPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.WriteModel)
 	event, err := c.addDefaultDomainPolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -83,7 +83,7 @@ func (c *Commands) defaultDomainPolicyWriteModelByID(ctx context.Context) (polic
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceDomainPolicyWriteModel()
+	writeModel := NewInstanceDomainPolicyWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_domain_model.go

@@ -3,9 +3,9 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 )
@@ -14,12 +14,12 @@ type InstanceDomainPolicyWriteModel struct {
 	PolicyDomainWriteModel
 }
 
-func NewInstanceDomainPolicyWriteModel() *InstanceDomainPolicyWriteModel {
+func NewInstanceDomainPolicyWriteModel(ctx context.Context) *InstanceDomainPolicyWriteModel {
 	return &InstanceDomainPolicyWriteModel{
 		PolicyDomainWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_domain_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -40,7 +41,7 @@ func TestCommandSide_AddDefaultDomainPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDomainPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -65,9 +66,10 @@ func TestCommandSide_AddDefaultDomainPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewDomainPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									true,
 								),
 							),
@@ -76,7 +78,7 @@ func TestCommandSide_AddDefaultDomainPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.DomainPolicy{
 					UserLoginMustBeDomain: true,
 				},
@@ -84,8 +86,9 @@ func TestCommandSide_AddDefaultDomainPolicy(t *testing.T) {
 			res: res{
 				want: &domain.DomainPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					UserLoginMustBeDomain: true,
 				},
@@ -155,7 +158,7 @@ func TestCommandSide_ChangeDefaultDomainPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDomainPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -180,7 +183,7 @@ func TestCommandSide_ChangeDefaultDomainPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewDomainPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						),
@@ -203,8 +206,8 @@ func TestCommandSide_ChangeDefaultDomainPolicy(t *testing.T) {
 			res: res{
 				want: &domain.DomainPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					UserLoginMustBeDomain: false,
 				},
@@ -232,7 +235,7 @@ func TestCommandSide_ChangeDefaultDomainPolicy(t *testing.T) {
 
 func newDefaultDomainPolicyChangedEvent(ctx context.Context, userLoginMustBeDomain bool) *instance.DomainPolicyChangedEvent {
 	event, _ := instance.NewDomainPolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.OrgPolicyChanges{
 			policy.ChangeUserLoginMustBeDomain(userLoginMustBeDomain),
 		},

internal/command/instance_policy_label.go

@@ -3,6 +3,7 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -11,7 +12,7 @@ import (
 )
 
 func (c *Commands) AddDefaultLabelPolicy(ctx context.Context, policy *domain.LabelPolicy) (*domain.LabelPolicy, error) {
-	addedPolicy := NewInstanceLabelPolicyWriteModel()
+	addedPolicy := NewInstanceLabelPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.LabelPolicyWriteModel.WriteModel)
 	event, err := c.addDefaultLabelPolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -157,7 +158,7 @@ func (c *Commands) RemoveLogoDefaultLabelPolicy(ctx context.Context) (*domain.Ob
 		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-Xc8Kf", "Errors.IAM.LabelPolicy.NotFound")
 	}
 
-	err = c.RemoveAsset(ctx, domain.IAMID, existingPolicy.LogoKey)
+	err = c.RemoveAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.LogoKey)
 	if err != nil {
 		return nil, err
 	}
@@ -206,7 +207,7 @@ func (c *Commands) RemoveIconDefaultLabelPolicy(ctx context.Context) (*domain.Ob
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
 		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-4M0qw", "Errors.IAM.LabelPolicy.NotFound")
 	}
-	err = c.RemoveAsset(ctx, domain.IAMID, existingPolicy.IconKey)
+	err = c.RemoveAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.IconKey)
 	if err != nil {
 		return nil, err
 	}
@@ -255,7 +256,7 @@ func (c *Commands) RemoveLogoDarkDefaultLabelPolicy(ctx context.Context) (*domai
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
 		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-3FGds", "Errors.IAM.LabelPolicy.NotFound")
 	}
-	err = c.RemoveAsset(ctx, domain.IAMID, existingPolicy.LogoDarkKey)
+	err = c.RemoveAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.LogoDarkKey)
 	if err != nil {
 		return nil, err
 	}
@@ -304,7 +305,7 @@ func (c *Commands) RemoveIconDarkDefaultLabelPolicy(ctx context.Context) (*domai
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
 		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-2nc7F", "Errors.IAM.LabelPolicy.NotFound")
 	}
-	err = c.RemoveAsset(ctx, domain.IAMID, existingPolicy.IconDarkKey)
+	err = c.RemoveAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.IconDarkKey)
 	if err != nil {
 		return nil, err
 	}
@@ -353,7 +354,7 @@ func (c *Commands) RemoveFontDefaultLabelPolicy(ctx context.Context) (*domain.Ob
 	if existingPolicy.State == domain.PolicyStateUnspecified || existingPolicy.State == domain.PolicyStateRemoved {
 		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-Tk0gw", "Errors.IAM.LabelPolicy.NotFound")
 	}
-	err = c.RemoveAsset(ctx, domain.IAMID, existingPolicy.FontKey)
+	err = c.RemoveAsset(ctx, authz.GetInstance(ctx).InstanceID(), existingPolicy.FontKey)
 	if err != nil {
 		return nil, err
 	}
@@ -373,7 +374,7 @@ func (c *Commands) defaultLabelPolicyWriteModelByID(ctx context.Context) (policy
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceLabelPolicyWriteModel()
+	writeModel := NewInstanceLabelPolicyWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_label_model.go

@@ -3,7 +3,7 @@ package command
 import (
 	"context"
 
-	"github.com/caos/zitadel/internal/domain"
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
@@ -13,12 +13,12 @@ type InstanceLabelPolicyWriteModel struct {
 	LabelPolicyWriteModel
 }
 
-func NewInstanceLabelPolicyWriteModel() *InstanceLabelPolicyWriteModel {
+func NewInstanceLabelPolicyWriteModel(ctx context.Context) *InstanceLabelPolicyWriteModel {
 	return &InstanceLabelPolicyWriteModel{
 		LabelPolicyWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_label_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 
@@ -44,7 +45,7 @@ func TestCommandSide_AddDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -89,9 +90,10 @@ func TestCommandSide_AddDefaultLabelPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewLabelPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"#ffffff",
 									"#ffffff",
 									"#ffffff",
@@ -110,7 +112,7 @@ func TestCommandSide_AddDefaultLabelPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.LabelPolicy{
 					PrimaryColor:        "#ffffff",
 					BackgroundColor:     "#ffffff",
@@ -128,8 +130,9 @@ func TestCommandSide_AddDefaultLabelPolicy(t *testing.T) {
 			res: res{
 				want: &domain.LabelPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					PrimaryColor:        "#ffffff",
 					BackgroundColor:     "#ffffff",
@@ -211,7 +214,7 @@ func TestCommandSide_ChangeDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -256,7 +259,7 @@ func TestCommandSide_ChangeDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -311,8 +314,8 @@ func TestCommandSide_ChangeDefaultLabelPolicy(t *testing.T) {
 			res: res{
 				want: &domain.LabelPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					PrimaryColor:        "#000000",
 					BackgroundColor:     "#000000",
@@ -388,7 +391,7 @@ func TestCommandSide_ActivateDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -407,7 +410,7 @@ func TestCommandSide_ActivateDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyActivatedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 								),
 							),
 						},
@@ -419,7 +422,7 @@ func TestCommandSide_ActivateDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -500,7 +503,7 @@ func TestCommandSide_AddLogoDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -519,7 +522,7 @@ func TestCommandSide_AddLogoDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyLogoAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -533,7 +536,7 @@ func TestCommandSide_AddLogoDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -600,7 +603,7 @@ func TestCommandSide_RemoveLogoDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -616,7 +619,7 @@ func TestCommandSide_RemoveLogoDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyLogoAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -639,7 +642,7 @@ func TestCommandSide_RemoveLogoDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -655,7 +658,7 @@ func TestCommandSide_RemoveLogoDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyLogoAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -664,7 +667,7 @@ func TestCommandSide_RemoveLogoDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyLogoRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -677,7 +680,7 @@ func TestCommandSide_RemoveLogoDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -758,7 +761,7 @@ func TestCommandSide_AddIconDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -777,7 +780,7 @@ func TestCommandSide_AddIconDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyIconAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -791,7 +794,7 @@ func TestCommandSide_AddIconDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -857,7 +860,7 @@ func TestCommandSide_RemoveIconDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -873,7 +876,7 @@ func TestCommandSide_RemoveIconDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyIconAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -882,7 +885,7 @@ func TestCommandSide_RemoveIconDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyIconRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -895,7 +898,7 @@ func TestCommandSide_RemoveIconDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -926,6 +929,7 @@ func TestCommandSide_AddLogoDarkDefaultLabelPolicy(t *testing.T) {
 	}
 	type args struct {
 		ctx        context.Context
+		instanceID string
 		storageKey string
 	}
 	type res struct {
@@ -946,7 +950,8 @@ func TestCommandSide_AddLogoDarkDefaultLabelPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 			},
 			res: res{
 				err: caos_errs.IsErrorInvalidArgument,
@@ -962,6 +967,7 @@ func TestCommandSide_AddLogoDarkDefaultLabelPolicy(t *testing.T) {
 			},
 			args: args{
 				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				storageKey: "key",
 			},
 			res: res{
@@ -976,7 +982,7 @@ func TestCommandSide_AddLogoDarkDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -995,7 +1001,7 @@ func TestCommandSide_AddLogoDarkDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyLogoDarkAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -1009,7 +1015,7 @@ func TestCommandSide_AddLogoDarkDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1075,7 +1081,7 @@ func TestCommandSide_RemoveLogoDarkDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1091,7 +1097,7 @@ func TestCommandSide_RemoveLogoDarkDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyLogoDarkAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -1114,7 +1120,7 @@ func TestCommandSide_RemoveLogoDarkDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1130,7 +1136,7 @@ func TestCommandSide_RemoveLogoDarkDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyLogoDarkAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -1139,7 +1145,7 @@ func TestCommandSide_RemoveLogoDarkDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyLogoDarkRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -1152,7 +1158,7 @@ func TestCommandSide_RemoveLogoDarkDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1233,7 +1239,7 @@ func TestCommandSide_AddIconDarkDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1252,7 +1258,7 @@ func TestCommandSide_AddIconDarkDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyIconDarkAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -1266,7 +1272,7 @@ func TestCommandSide_AddIconDarkDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1332,7 +1338,7 @@ func TestCommandSide_RemoveIconDarkDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1348,7 +1354,7 @@ func TestCommandSide_RemoveIconDarkDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyIconDarkAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -1371,7 +1377,7 @@ func TestCommandSide_RemoveIconDarkDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1387,7 +1393,7 @@ func TestCommandSide_RemoveIconDarkDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyIconDarkAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -1396,7 +1402,7 @@ func TestCommandSide_RemoveIconDarkDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyIconDarkRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -1409,7 +1415,7 @@ func TestCommandSide_RemoveIconDarkDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1490,7 +1496,7 @@ func TestCommandSide_AddFontDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1509,7 +1515,7 @@ func TestCommandSide_AddFontDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyFontAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -1523,7 +1529,7 @@ func TestCommandSide_AddFontDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1589,7 +1595,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1605,7 +1611,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyFontAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -1628,7 +1634,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -1644,7 +1650,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewLabelPolicyFontAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"key",
 							),
 						),
@@ -1653,7 +1659,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLabelPolicyFontRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"key",
 								),
 							),
@@ -1666,7 +1672,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1693,7 +1699,7 @@ func TestCommandSide_RemoveFontDefaultLabelPolicy(t *testing.T) {
 
 func newDefaultLabelPolicyChangedEvent(ctx context.Context, primaryColor, backgroundColor, warnColor, fontColor, primaryColorDark, backgroundColorDark, warnColorDark, fontColorDark string, hideLoginNameSuffix, errMsgPopup, disableWatermark bool) *instance.LabelPolicyChangedEvent {
 	event, _ := instance.NewLabelPolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.LabelPolicyChanges{
 			policy.ChangePrimaryColor(primaryColor),
 			policy.ChangeBackgroundColor(backgroundColor),

internal/command/instance_policy_login.go

@@ -12,7 +12,7 @@ import (
 )
 
 func (c *Commands) getDefaultLoginPolicy(ctx context.Context) (*domain.LoginPolicy, error) {
-	policyWriteModel := NewInstanceLoginPolicyWriteModel()
+	policyWriteModel := NewInstanceLoginPolicyWriteModel(ctx)
 	err := c.eventstore.FilterToQueryReducer(ctx, policyWriteModel)
 	if err != nil {
 		return nil, err
@@ -23,7 +23,7 @@ func (c *Commands) getDefaultLoginPolicy(ctx context.Context) (*domain.LoginPoli
 }
 
 func (c *Commands) AddDefaultLoginPolicy(ctx context.Context, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
-	addedPolicy := NewInstanceLoginPolicyWriteModel()
+	addedPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.WriteModel)
 	event, err := c.addDefaultLoginPolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -65,7 +65,7 @@ func (c *Commands) addDefaultLoginPolicy(ctx context.Context, instanceAgg *event
 }
 
 func (c *Commands) ChangeDefaultLoginPolicy(ctx context.Context, policy *domain.LoginPolicy) (*domain.LoginPolicy, error) {
-	existingPolicy := NewInstanceLoginPolicyWriteModel()
+	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&existingPolicy.LoginPolicyWriteModel.WriteModel)
 	event, err := c.changeDefaultLoginPolicy(ctx, instanceAgg, existingPolicy, policy)
 	if err != nil {
@@ -113,7 +113,7 @@ func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpPr
 	if !idpProvider.IsValid() {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-9nf88", "Errors.IAM.LoginPolicy.IDP.Invalid")
 	}
-	existingPolicy := NewInstanceLoginPolicyWriteModel()
+	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	err := c.defaultLoginPolicyWriteModelByID(ctx, existingPolicy)
 	if err != nil {
 		return nil, err
@@ -126,7 +126,7 @@ func (c *Commands) AddIDPProviderToDefaultLoginPolicy(ctx context.Context, idpPr
 	if err != nil {
 		return nil, caos_errs.ThrowPreconditionFailed(err, "INSTANCE-m8fsd", "Errors.IDPConfig.NotExisting")
 	}
-	idpModel := NewInstanceIdentityProviderWriteModel(idpProvider.IDPConfigID)
+	idpModel := NewInstanceIdentityProviderWriteModel(ctx, idpProvider.IDPConfigID)
 	err = c.eventstore.FilterToQueryReducer(ctx, idpModel)
 	if err != nil {
 		return nil, err
@@ -151,7 +151,7 @@ func (c *Commands) RemoveIDPProviderFromDefaultLoginPolicy(ctx context.Context,
 	if !idpProvider.IsValid() {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-66m9s", "Errors.IAM.LoginPolicy.IDP.Invalid")
 	}
-	existingPolicy := NewInstanceLoginPolicyWriteModel()
+	existingPolicy := NewInstanceLoginPolicyWriteModel(ctx)
 	err := c.defaultLoginPolicyWriteModelByID(ctx, existingPolicy)
 	if err != nil {
 		return nil, err
@@ -160,7 +160,7 @@ func (c *Commands) RemoveIDPProviderFromDefaultLoginPolicy(ctx context.Context,
 		return nil, caos_errs.ThrowNotFound(nil, "INSTANCE-Dfg4t", "Errors.IAM.LoginPolicy.NotFound")
 	}
 
-	idpModel := NewInstanceIdentityProviderWriteModel(idpProvider.IDPConfigID)
+	idpModel := NewInstanceIdentityProviderWriteModel(ctx, idpProvider.IDPConfigID)
 	err = c.eventstore.FilterToQueryReducer(ctx, idpModel)
 	if err != nil {
 		return nil, err
@@ -193,7 +193,7 @@ func (c *Commands) removeIDPProviderFromDefaultLoginPolicy(ctx context.Context,
 	for _, idp := range cascadeExternalIDPs {
 		userEvent, _, err := c.removeUserIDPLink(ctx, idp, true)
 		if err != nil {
-			logging.LogWithFields("COMMAND-4nfsf", "userid", idp.AggregateID, "idp-id", idp.IDPConfigID).WithError(err).Warn("could not cascade remove externalidp in remove provider from policy")
+			logging.WithFields("COMMAND-4nfsf", "userid", idp.AggregateID, "idp-id", idp.IDPConfigID).WithError(err).Warn("could not cascade remove externalidp in remove provider from policy")
 			continue
 		}
 		events = append(events, userEvent)
@@ -205,7 +205,7 @@ func (c *Commands) AddSecondFactorToDefaultLoginPolicy(ctx context.Context, seco
 	if !secondFactor.Valid() {
 		return domain.SecondFactorTypeUnspecified, nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-5m9fs", "Errors.IAM.LoginPolicy.MFA.Unspecified")
 	}
-	secondFactorModel := NewInstanceSecondFactorWriteModel(secondFactor)
+	secondFactorModel := NewInstanceSecondFactorWriteModel(ctx, secondFactor)
 	instanceAgg := InstanceAggregateFromWriteModel(&secondFactorModel.SecondFactorWriteModel.WriteModel)
 	event, err := c.addSecondFactorToDefaultLoginPolicy(ctx, instanceAgg, secondFactorModel, secondFactor)
 	if err != nil {
@@ -239,7 +239,7 @@ func (c *Commands) RemoveSecondFactorFromDefaultLoginPolicy(ctx context.Context,
 	if !secondFactor.Valid() {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-55n8s", "Errors.IAM.LoginPolicy.MFA.Unspecified")
 	}
-	secondFactorModel := NewInstanceSecondFactorWriteModel(secondFactor)
+	secondFactorModel := NewInstanceSecondFactorWriteModel(ctx, secondFactor)
 	err := c.eventstore.FilterToQueryReducer(ctx, secondFactorModel)
 	if err != nil {
 		return nil, err
@@ -263,7 +263,7 @@ func (c *Commands) AddMultiFactorToDefaultLoginPolicy(ctx context.Context, multi
 	if !multiFactor.Valid() {
 		return domain.MultiFactorTypeUnspecified, nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-5m9fs", "Errors.IAM.LoginPolicy.MFA.Unspecified")
 	}
-	multiFactorModel := NewInstanceMultiFactorWriteModel(multiFactor)
+	multiFactorModel := NewInstanceMultiFactorWriteModel(ctx, multiFactor)
 	instanceAgg := InstanceAggregateFromWriteModel(&multiFactorModel.MultiFactorWriteModel.WriteModel)
 	event, err := c.addMultiFactorToDefaultLoginPolicy(ctx, instanceAgg, multiFactorModel, multiFactor)
 	if err != nil {
@@ -297,7 +297,7 @@ func (c *Commands) RemoveMultiFactorFromDefaultLoginPolicy(ctx context.Context,
 	if !multiFactor.Valid() {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "INSTANCE-33m9F", "Errors.IAM.LoginPolicy.MFA.Unspecified")
 	}
-	multiFactorModel := NewInstanceMultiFactorWriteModel(multiFactor)
+	multiFactorModel := NewInstanceMultiFactorWriteModel(ctx, multiFactor)
 	err := c.eventstore.FilterToQueryReducer(ctx, multiFactorModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_login_factors_model.go

@@ -1,6 +1,9 @@
 package command
 
 import (
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
@@ -10,12 +13,12 @@ type InstanceSecondFactorWriteModel struct {
 	SecondFactorWriteModel
 }
 
-func NewInstanceSecondFactorWriteModel(factorType domain.SecondFactorType) *InstanceSecondFactorWriteModel {
+func NewInstanceSecondFactorWriteModel(ctx context.Context, factorType domain.SecondFactorType) *InstanceSecondFactorWriteModel {
 	return &InstanceSecondFactorWriteModel{
 		SecondFactorWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			MFAType: factorType,
 		},
@@ -57,12 +60,12 @@ type InstanceMultiFactorWriteModel struct {
 	MultiFactorWriteModel
 }
 
-func NewInstanceMultiFactorWriteModel(factorType domain.MultiFactorType) *InstanceMultiFactorWriteModel {
+func NewInstanceMultiFactorWriteModel(ctx context.Context, factorType domain.MultiFactorType) *InstanceMultiFactorWriteModel {
 	return &InstanceMultiFactorWriteModel{
 		MultiFactorWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			MFAType: factorType,
 		},

internal/command/instance_policy_login_identity_provider_model.go

@@ -1,7 +1,9 @@
 package command
 
 import (
-	"github.com/caos/zitadel/internal/domain"
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 )
@@ -10,12 +12,12 @@ type InstanceIdentityProviderWriteModel struct {
 	IdentityProviderWriteModel
 }
 
-func NewInstanceIdentityProviderWriteModel(idpConfigID string) *InstanceIdentityProviderWriteModel {
+func NewInstanceIdentityProviderWriteModel(ctx context.Context, idpConfigID string) *InstanceIdentityProviderWriteModel {
 	return &InstanceIdentityProviderWriteModel{
 		IdentityProviderWriteModel: IdentityProviderWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 			IDPConfigID: idpConfigID,
 		},

internal/command/instance_policy_login_model.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -15,12 +16,12 @@ type InstanceLoginPolicyWriteModel struct {
 	LoginPolicyWriteModel
 }
 
-func NewInstanceLoginPolicyWriteModel() *InstanceLoginPolicyWriteModel {
+func NewInstanceLoginPolicyWriteModel(ctx context.Context) *InstanceLoginPolicyWriteModel {
 	return &InstanceLoginPolicyWriteModel{
 		LoginPolicyWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_login_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -43,7 +44,7 @@ func TestCommandSide_AddDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								false,
@@ -80,9 +81,10 @@ func TestCommandSide_AddDefaultLoginPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewLoginPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									true,
 									true,
 									true,
@@ -101,7 +103,7 @@ func TestCommandSide_AddDefaultLoginPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.LoginPolicy{
 					AllowRegister:              true,
 					AllowUsernamePassword:      true,
@@ -119,8 +121,9 @@ func TestCommandSide_AddDefaultLoginPolicy(t *testing.T) {
 			res: res{
 				want: &domain.LoginPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					AllowRegister:              true,
 					AllowUsernamePassword:      true,
@@ -201,7 +204,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -244,9 +247,10 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -263,7 +267,8 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 					),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								newDefaultLoginPolicyChangedEvent(context.Background(),
 									false,
 									false,
@@ -282,7 +287,7 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.LoginPolicy{
 					AllowRegister:              false,
 					AllowUsernamePassword:      false,
@@ -300,8 +305,9 @@ func TestCommandSide_ChangeDefaultLoginPolicy(t *testing.T) {
 			res: res{
 				want: &domain.LoginPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					AllowRegister:              false,
 					AllowUsernamePassword:      false,
@@ -396,7 +402,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -432,7 +438,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -450,7 +456,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name",
 								domain.IDPConfigTypeOIDC,
@@ -462,7 +468,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIdentityProviderAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 							),
 						),
@@ -485,9 +491,10 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 				eventstore: eventstoreExpect(
 					t,
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -503,9 +510,10 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 						),
 					),
 					expectFilter(
-						eventFromEventPusher(
+						eventFromEventPusherWithInstanceID(
+							"INSTANCE",
 							instance.NewIDPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 								"name",
 								domain.IDPConfigTypeOIDC,
@@ -517,9 +525,10 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewIdentityProviderAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1"),
 							),
 						},
@@ -527,7 +536,7 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				provider: &domain.IDPProvider{
 					IDPConfigID: "config1",
 				},
@@ -535,8 +544,9 @@ func TestCommandSide_AddIDPProviderDefaultLoginPolicy(t *testing.T) {
 			res: res{
 				want: &domain.IDPProvider{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					IDPConfigID: "config1",
 				},
@@ -622,7 +632,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -658,7 +668,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -676,13 +686,13 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIdentityProviderAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 							),
 						),
 						eventFromEventPusher(
 							instance.NewIdentityProviderRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 							),
 						),
@@ -707,7 +717,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -725,7 +735,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIdentityProviderAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 							),
 						),
@@ -734,7 +744,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewIdentityProviderRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1"),
 							),
 						},
@@ -749,7 +759,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -761,7 +771,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -779,7 +789,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIdentityProviderAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 							),
 						),
@@ -788,7 +798,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewIdentityProviderRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1"),
 							),
 						},
@@ -811,7 +821,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -823,7 +833,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -841,7 +851,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewIdentityProviderAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"config1",
 							),
 						),
@@ -857,7 +867,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewIdentityProviderRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"config1"),
 							),
 							eventFromEventPusher(
@@ -886,7 +896,7 @@ func TestCommandSide_RemoveIDPProviderDefaultLoginPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -951,7 +961,7 @@ func TestCommandSide_AddSecondFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicySecondFactorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecondFactorTypeOTP,
 							),
 						),
@@ -974,9 +984,10 @@ func TestCommandSide_AddSecondFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewLoginPolicySecondFactorAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									domain.SecondFactorTypeOTP),
 							),
 						},
@@ -984,12 +995,12 @@ func TestCommandSide_AddSecondFactorDefaultLoginPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx:    context.Background(),
+				ctx:    authz.WithInstanceID(context.Background(), "INSTANCE"),
 				factor: domain.SecondFactorTypeOTP,
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1070,13 +1081,13 @@ func TestCommandSide_RemoveSecondFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicySecondFactorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecondFactorTypeOTP,
 							),
 						),
 						eventFromEventPusher(
 							instance.NewLoginPolicySecondFactorRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecondFactorTypeOTP,
 							),
 						),
@@ -1099,7 +1110,7 @@ func TestCommandSide_RemoveSecondFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicySecondFactorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecondFactorTypeOTP,
 							),
 						),
@@ -1108,7 +1119,7 @@ func TestCommandSide_RemoveSecondFactorDefaultLoginPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLoginPolicySecondFactorRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									domain.SecondFactorTypeOTP),
 							),
 						},
@@ -1121,7 +1132,7 @@ func TestCommandSide_RemoveSecondFactorDefaultLoginPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1186,7 +1197,7 @@ func TestCommandSide_AddMultiFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyMultiFactorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.MultiFactorTypeU2FWithPIN,
 							),
 						),
@@ -1209,9 +1220,10 @@ func TestCommandSide_AddMultiFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewLoginPolicyMultiFactorAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									domain.MultiFactorTypeU2FWithPIN),
 							),
 						},
@@ -1219,12 +1231,12 @@ func TestCommandSide_AddMultiFactorDefaultLoginPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx:    context.Background(),
+				ctx:    authz.WithInstanceID(context.Background(), "INSTANCE"),
 				factor: domain.MultiFactorTypeU2FWithPIN,
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1305,13 +1317,13 @@ func TestCommandSide_RemoveMultiFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyMultiFactorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.MultiFactorTypeU2FWithPIN,
 							),
 						),
 						eventFromEventPusher(
 							instance.NewLoginPolicyMultiFactorRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.MultiFactorTypeU2FWithPIN,
 							),
 						),
@@ -1334,7 +1346,7 @@ func TestCommandSide_RemoveMultiFactorDefaultLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyMultiFactorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.MultiFactorTypeU2FWithPIN,
 							),
 						),
@@ -1343,7 +1355,7 @@ func TestCommandSide_RemoveMultiFactorDefaultLoginPolicy(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewLoginPolicyMultiFactorRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									domain.MultiFactorTypeU2FWithPIN),
 							),
 						},
@@ -1356,7 +1368,7 @@ func TestCommandSide_RemoveMultiFactorDefaultLoginPolicy(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -1384,7 +1396,7 @@ func newDefaultLoginPolicyChangedEvent(ctx context.Context, allowRegister, allow
 	passwordlessType domain.PasswordlessType,
 	passwordLifetime, externalLoginLifetime, mfaInitSkipLifetime, secondFactorLifetime, multiFactorLifetime time.Duration) *instance.LoginPolicyChangedEvent {
 	event, _ := instance.NewLoginPolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.LoginPolicyChanges{
 			policy.ChangeAllowRegister(allowRegister),
 			policy.ChangeAllowExternalIDP(allowExternalIDP),

internal/command/instance_policy_mail_template.go

@@ -11,7 +11,7 @@ import (
 )
 
 func (c *Commands) AddDefaultMailTemplate(ctx context.Context, policy *domain.MailTemplate) (*domain.MailTemplate, error) {
-	addedPolicy := NewInstanceMailTemplateWriteModel()
+	addedPolicy := NewInstanceMailTemplateWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.MailTemplateWriteModel.WriteModel)
 	event, err := c.addDefaultMailTemplate(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -86,7 +86,7 @@ func (c *Commands) defaultMailTemplateWriteModelByID(ctx context.Context) (polic
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceMailTemplateWriteModel()
+	writeModel := NewInstanceMailTemplateWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_mail_template_model.go

@@ -4,9 +4,9 @@ import (
 	"context"
 	"reflect"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 )
@@ -15,12 +15,12 @@ type InstanceMailTemplateWriteModel struct {
 	MailTemplateWriteModel
 }
 
-func NewInstanceMailTemplateWriteModel() *InstanceMailTemplateWriteModel {
+func NewInstanceMailTemplateWriteModel(ctx context.Context) *InstanceMailTemplateWriteModel {
 	return &InstanceMailTemplateWriteModel{
 		MailTemplateWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_mail_template_test.go

@@ -2,6 +2,9 @@ package command
 
 import (
 	"context"
+	"testing"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -10,7 +13,6 @@ import (
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 	"github.com/stretchr/testify/assert"
-	"testing"
 )
 
 func TestCommandSide_AddDefaultMailTemplatePolicy(t *testing.T) {
@@ -54,7 +56,7 @@ func TestCommandSide_AddDefaultMailTemplatePolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMailTemplateAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								[]byte("template"),
 							),
 						),
@@ -79,9 +81,10 @@ func TestCommandSide_AddDefaultMailTemplatePolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewMailTemplateAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									[]byte("template"),
 								),
 							),
@@ -90,7 +93,7 @@ func TestCommandSide_AddDefaultMailTemplatePolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.MailTemplate{
 					Template: []byte("template"),
 				},
@@ -98,8 +101,9 @@ func TestCommandSide_AddDefaultMailTemplatePolicy(t *testing.T) {
 			res: res{
 				want: &domain.MailTemplate{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					Template: []byte("template"),
 				},
@@ -184,7 +188,7 @@ func TestCommandSide_ChangeDefaultMailTemplatePolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMailTemplateAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								[]byte("template"),
 							),
 						),
@@ -209,7 +213,7 @@ func TestCommandSide_ChangeDefaultMailTemplatePolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewMailTemplateAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								[]byte("template"),
 							),
 						),
@@ -232,8 +236,8 @@ func TestCommandSide_ChangeDefaultMailTemplatePolicy(t *testing.T) {
 			res: res{
 				want: &domain.MailTemplate{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					Template: []byte("template-change"),
 				},
@@ -261,7 +265,7 @@ func TestCommandSide_ChangeDefaultMailTemplatePolicy(t *testing.T) {
 
 func newDefaultMailTemplatePolicyChangedEvent(ctx context.Context, template []byte) *instance.MailTemplateChangedEvent {
 	event, _ := instance.NewMailTemplateChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.MailTemplateChanges{
 			policy.ChangeTemplate(template),
 		},

internal/command/instance_policy_password_age.go

@@ -11,7 +11,7 @@ import (
 )
 
 func (c *Commands) AddDefaultPasswordAgePolicy(ctx context.Context, policy *domain.PasswordAgePolicy) (*domain.PasswordAgePolicy, error) {
-	addedPolicy := NewInstancePasswordAgePolicyWriteModel()
+	addedPolicy := NewInstancePasswordAgePolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.WriteModel)
 	event, err := c.addDefaultPasswordAgePolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -73,7 +73,7 @@ func (c *Commands) defaultPasswordAgePolicyWriteModelByID(ctx context.Context) (
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstancePasswordAgePolicyWriteModel()
+	writeModel := NewInstancePasswordAgePolicyWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_password_age_test.go

@@ -2,6 +2,9 @@ package command
 
 import (
 	"context"
+	"testing"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -10,7 +13,6 @@ import (
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 	"github.com/stretchr/testify/assert"
-	"testing"
 )
 
 func TestCommandSide_AddDefaultPasswordAgePolicy(t *testing.T) {
@@ -39,7 +41,7 @@ func TestCommandSide_AddDefaultPasswordAgePolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPasswordAgePolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								365,
 								10,
 							),
@@ -66,9 +68,10 @@ func TestCommandSide_AddDefaultPasswordAgePolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewPasswordAgePolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									365,
 									10,
 								),
@@ -78,7 +81,7 @@ func TestCommandSide_AddDefaultPasswordAgePolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.PasswordAgePolicy{
 					ExpireWarnDays: 365,
 					MaxAgeDays:     10,
@@ -87,8 +90,9 @@ func TestCommandSide_AddDefaultPasswordAgePolicy(t *testing.T) {
 			res: res{
 				want: &domain.PasswordAgePolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					ExpireWarnDays: 365,
 					MaxAgeDays:     10,
@@ -160,7 +164,7 @@ func TestCommandSide_ChangeDefaultPasswordAgePolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPasswordAgePolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								365,
 								10,
 							),
@@ -187,7 +191,7 @@ func TestCommandSide_ChangeDefaultPasswordAgePolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPasswordAgePolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								365,
 								10,
 							),
@@ -212,8 +216,8 @@ func TestCommandSide_ChangeDefaultPasswordAgePolicy(t *testing.T) {
 			res: res{
 				want: &domain.PasswordAgePolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					MaxAgeDays:     125,
 					ExpireWarnDays: 5,
@@ -242,7 +246,7 @@ func TestCommandSide_ChangeDefaultPasswordAgePolicy(t *testing.T) {
 
 func newDefaultPasswordAgePolicyChangedEvent(ctx context.Context, maxAgeDays, expiryWarnDays uint64) *instance.PasswordAgePolicyChangedEvent {
 	event, _ := instance.NewPasswordAgePolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.PasswordAgePolicyChanges{
 			policy.ChangeExpireWarnDays(expiryWarnDays),
 			policy.ChangeMaxAgeDays(maxAgeDays),

internal/command/instance_policy_password_complexity.go

@@ -11,7 +11,7 @@ import (
 )
 
 func (c *Commands) getDefaultPasswordComplexityPolicy(ctx context.Context) (*domain.PasswordComplexityPolicy, error) {
-	policyWriteModel := NewInstancePasswordComplexityPolicyWriteModel()
+	policyWriteModel := NewInstancePasswordComplexityPolicyWriteModel(ctx)
 	err := c.eventstore.FilterToQueryReducer(ctx, policyWriteModel)
 	if err != nil {
 		return nil, err
@@ -25,7 +25,7 @@ func (c *Commands) getDefaultPasswordComplexityPolicy(ctx context.Context) (*dom
 }
 
 func (c *Commands) AddDefaultPasswordComplexityPolicy(ctx context.Context, policy *domain.PasswordComplexityPolicy) (*domain.PasswordComplexityPolicy, error) {
-	addedPolicy := NewInstancePasswordComplexityPolicyWriteModel()
+	addedPolicy := NewInstancePasswordComplexityPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.WriteModel)
 	events, err := c.addDefaultPasswordComplexityPolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -92,7 +92,7 @@ func (c *Commands) defaultPasswordComplexityPolicyWriteModelByID(ctx context.Con
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstancePasswordComplexityPolicyWriteModel()
+	writeModel := NewInstancePasswordComplexityPolicyWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_password_complexity_model.go

@@ -3,9 +3,9 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 )
@@ -14,12 +14,12 @@ type InstancePasswordComplexityPolicyWriteModel struct {
 	PasswordComplexityPolicyWriteModel
 }
 
-func NewInstancePasswordComplexityPolicyWriteModel() *InstancePasswordComplexityPolicyWriteModel {
+func NewInstancePasswordComplexityPolicyWriteModel(ctx context.Context) *InstancePasswordComplexityPolicyWriteModel {
 	return &InstancePasswordComplexityPolicyWriteModel{
 		PasswordComplexityPolicyWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_password_complexity_test.go

@@ -2,6 +2,9 @@ package command
 
 import (
 	"context"
+	"testing"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -10,7 +13,6 @@ import (
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 	"github.com/stretchr/testify/assert"
-	"testing"
 )
 
 func TestCommandSide_AddDefaultPasswordComplexityPolicy(t *testing.T) {
@@ -60,7 +62,7 @@ func TestCommandSide_AddDefaultPasswordComplexityPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								true, true, true, true,
 							),
@@ -69,7 +71,7 @@ func TestCommandSide_AddDefaultPasswordComplexityPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.PasswordComplexityPolicy{
 					MinLength:    8,
 					HasUppercase: true,
@@ -90,9 +92,10 @@ func TestCommandSide_AddDefaultPasswordComplexityPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewPasswordComplexityPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									8,
 									true, true, true, true,
 								),
@@ -102,7 +105,7 @@ func TestCommandSide_AddDefaultPasswordComplexityPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.PasswordComplexityPolicy{
 					MinLength:    8,
 					HasUppercase: true,
@@ -114,8 +117,9 @@ func TestCommandSide_AddDefaultPasswordComplexityPolicy(t *testing.T) {
 			res: res{
 				want: &domain.PasswordComplexityPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					MinLength:    8,
 					HasUppercase: true,
@@ -214,7 +218,7 @@ func TestCommandSide_ChangeDefaultPasswordComplexityPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								true, true, true, true,
 							),
@@ -244,7 +248,7 @@ func TestCommandSide_ChangeDefaultPasswordComplexityPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								true, true, true, true,
 							),
@@ -272,8 +276,8 @@ func TestCommandSide_ChangeDefaultPasswordComplexityPolicy(t *testing.T) {
 			res: res{
 				want: &domain.PasswordComplexityPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					MinLength:    10,
 					HasUppercase: false,
@@ -305,7 +309,7 @@ func TestCommandSide_ChangeDefaultPasswordComplexityPolicy(t *testing.T) {
 
 func newDefaultPasswordComplexityPolicyChangedEvent(ctx context.Context, minLength uint64, hasUpper, hasLower, hasNumber, hasSymbol bool) *instance.PasswordComplexityPolicyChangedEvent {
 	event, _ := instance.NewPasswordComplexityPolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.PasswordComplexityPolicyChanges{
 			policy.ChangeMinLength(minLength),
 			policy.ChangeHasUppercase(hasUpper),

internal/command/instance_policy_password_lockout.go

@@ -11,7 +11,7 @@ import (
 )
 
 func (c *Commands) AddDefaultLockoutPolicy(ctx context.Context, policy *domain.LockoutPolicy) (*domain.LockoutPolicy, error) {
-	addedPolicy := NewInstanceLockoutPolicyWriteModel()
+	addedPolicy := NewInstanceLockoutPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.WriteModel)
 	event, err := c.addDefaultLockoutPolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -71,7 +71,7 @@ func (c *Commands) defaultLockoutPolicyWriteModelByID(ctx context.Context) (poli
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstanceLockoutPolicyWriteModel()
+	writeModel := NewInstanceLockoutPolicyWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_password_lockout_model.go

@@ -3,9 +3,9 @@ package command
 import (
 	"context"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 
-	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
 )
@@ -14,12 +14,12 @@ type InstanceLockoutPolicyWriteModel struct {
 	LockoutPolicyWriteModel
 }
 
-func NewInstanceLockoutPolicyWriteModel() *InstanceLockoutPolicyWriteModel {
+func NewInstanceLockoutPolicyWriteModel(ctx context.Context) *InstanceLockoutPolicyWriteModel {
 	return &InstanceLockoutPolicyWriteModel{
 		LockoutPolicyWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_password_lockout_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	caos_errs "github.com/caos/zitadel/internal/errors"
 	"github.com/caos/zitadel/internal/eventstore"
@@ -40,7 +41,7 @@ func TestCommandSide_AddDefaultLockoutPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								10,
 								true,
 							),
@@ -67,9 +68,10 @@ func TestCommandSide_AddDefaultLockoutPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewLockoutPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									10,
 									true,
 								),
@@ -79,7 +81,7 @@ func TestCommandSide_AddDefaultLockoutPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.LockoutPolicy{
 					MaxPasswordAttempts: 10,
 					ShowLockOutFailures: true,
@@ -88,8 +90,9 @@ func TestCommandSide_AddDefaultLockoutPolicy(t *testing.T) {
 			res: res{
 				want: &domain.LockoutPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					MaxPasswordAttempts: 10,
 					ShowLockOutFailures: true,
@@ -161,7 +164,7 @@ func TestCommandSide_ChangeDefaultLockoutPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								10,
 								true,
 							),
@@ -188,7 +191,7 @@ func TestCommandSide_ChangeDefaultLockoutPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								10,
 								true,
 							),
@@ -213,8 +216,8 @@ func TestCommandSide_ChangeDefaultLockoutPolicy(t *testing.T) {
 			res: res{
 				want: &domain.LockoutPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					MaxPasswordAttempts: 20,
 					ShowLockOutFailures: false,
@@ -243,7 +246,7 @@ func TestCommandSide_ChangeDefaultLockoutPolicy(t *testing.T) {
 
 func newDefaultLockoutPolicyChangedEvent(ctx context.Context, maxAttempts uint64, showLockoutFailure bool) *instance.LockoutPolicyChangedEvent {
 	event, _ := instance.NewLockoutPolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.LockoutPolicyChanges{
 			policy.ChangeMaxAttempts(maxAttempts),
 			policy.ChangeShowLockOutFailures(showLockoutFailure),

internal/command/instance_policy_privacy.go

@@ -11,7 +11,7 @@ import (
 )
 
 func (c *Commands) getDefaultPrivacyPolicy(ctx context.Context) (*domain.PrivacyPolicy, error) {
-	policyWriteModel := NewInstancePrivacyPolicyWriteModel()
+	policyWriteModel := NewInstancePrivacyPolicyWriteModel(ctx)
 	err := c.eventstore.FilterToQueryReducer(ctx, policyWriteModel)
 	if err != nil {
 		return nil, err
@@ -25,7 +25,7 @@ func (c *Commands) getDefaultPrivacyPolicy(ctx context.Context) (*domain.Privacy
 }
 
 func (c *Commands) AddDefaultPrivacyPolicy(ctx context.Context, policy *domain.PrivacyPolicy) (*domain.PrivacyPolicy, error) {
-	addedPolicy := NewInstancePrivacyPolicyWriteModel()
+	addedPolicy := NewInstancePrivacyPolicyWriteModel(ctx)
 	instanceAgg := InstanceAggregateFromWriteModel(&addedPolicy.WriteModel)
 	events, err := c.addDefaultPrivacyPolicy(ctx, instanceAgg, addedPolicy, policy)
 	if err != nil {
@@ -84,7 +84,7 @@ func (c *Commands) defaultPrivacyPolicyWriteModelByID(ctx context.Context) (poli
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewInstancePrivacyPolicyWriteModel()
+	writeModel := NewInstancePrivacyPolicyWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_policy_privacy_model.go

@@ -3,7 +3,7 @@ package command
 import (
 	"context"
 
-	"github.com/caos/zitadel/internal/domain"
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
 	"github.com/caos/zitadel/internal/repository/policy"
@@ -13,12 +13,12 @@ type InstancePrivacyPolicyWriteModel struct {
 	PrivacyPolicyWriteModel
 }
 
-func NewInstancePrivacyPolicyWriteModel() *InstancePrivacyPolicyWriteModel {
+func NewInstancePrivacyPolicyWriteModel(ctx context.Context) *InstancePrivacyPolicyWriteModel {
 	return &InstancePrivacyPolicyWriteModel{
 		PrivacyPolicyWriteModel{
 			WriteModel: eventstore.WriteModel{
-				AggregateID:   domain.IAMID,
-				ResourceOwner: domain.IAMID,
+				AggregateID:   authz.GetInstance(ctx).InstanceID(),
+				ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 			},
 		},
 	}

internal/command/instance_policy_privacy_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -41,7 +42,7 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"TOSLink",
 								"PrivacyLink",
 								"HelpLink",
@@ -70,9 +71,10 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewPrivacyPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"TOSLink",
 									"PrivacyLink",
 									"HelpLink",
@@ -83,7 +85,7 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.PrivacyPolicy{
 					TOSLink:     "TOSLink",
 					PrivacyLink: "PrivacyLink",
@@ -93,8 +95,9 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 			res: res{
 				want: &domain.PrivacyPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					TOSLink:     "TOSLink",
 					PrivacyLink: "PrivacyLink",
@@ -110,9 +113,10 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
 								instance.NewPrivacyPolicyAddedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"",
 									"",
 									"",
@@ -123,7 +127,7 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				policy: &domain.PrivacyPolicy{
 					TOSLink:     "",
 					PrivacyLink: "",
@@ -133,8 +137,9 @@ func TestCommandSide_AddDefaultPrivacyPolicy(t *testing.T) {
 			res: res{
 				want: &domain.PrivacyPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						InstanceID:    "INSTANCE",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					TOSLink:     "",
 					PrivacyLink: "",
@@ -208,7 +213,7 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"TOSLink",
 								"PrivacyLink",
 								"HelpLink",
@@ -237,7 +242,7 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"TOSLink",
 								"PrivacyLink",
 								"HelpLink",
@@ -268,8 +273,8 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) {
 			res: res{
 				want: &domain.PrivacyPolicy{
 					ObjectRoot: models.ObjectRoot{
-						AggregateID:   "IAM",
-						ResourceOwner: "IAM",
+						AggregateID:   "INSTANCE",
+						ResourceOwner: "INSTANCE",
 					},
 					TOSLink:     "TOSLinkChanged",
 					PrivacyLink: "PrivacyLinkChanged",
@@ -299,7 +304,7 @@ func TestCommandSide_ChangeDefaultPrivacyPolicy(t *testing.T) {
 
 func newDefaultPrivacyPolicyChangedEvent(ctx context.Context, tosLink, privacyLink, helpLink string) *instance.PrivacyPolicyChangedEvent {
 	event, _ := instance.NewPrivacyPolicyChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]policy.PrivacyPolicyChanges{
 			policy.ChangeTOSLink(tosLink),
 			policy.ChangePrivacyLink(privacyLink),

internal/command/instance_secret_generator_model.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
@@ -22,11 +23,11 @@ type InstanceSecretGeneratorConfigWriteModel struct {
 	State               domain.SecretGeneratorState
 }
 
-func NewInstanceSecretGeneratorConfigWriteModel(GeneratorType domain.SecretGeneratorType) *InstanceSecretGeneratorConfigWriteModel {
+func NewInstanceSecretGeneratorConfigWriteModel(ctx context.Context, GeneratorType domain.SecretGeneratorType) *InstanceSecretGeneratorConfigWriteModel {
 	return &InstanceSecretGeneratorConfigWriteModel{
 		WriteModel: eventstore.WriteModel{
-			AggregateID:   domain.IAMID,
-			ResourceOwner: domain.IAMID,
+			AggregateID:   authz.GetInstance(ctx).InstanceID(),
+			ResourceOwner: authz.GetInstance(ctx).InstanceID(),
 		},
 		GeneratorType: GeneratorType,
 	}

internal/command/instance_settings.go

@@ -108,7 +108,7 @@ func (c *Commands) RemoveSecretGeneratorConfig(ctx context.Context, generatorTyp
 }
 
 func (c *Commands) getSecretConfig(ctx context.Context, generatorType domain.SecretGeneratorType) (_ *InstanceSecretGeneratorConfigWriteModel, err error) {
-	writeModel := NewInstanceSecretGeneratorConfigWriteModel(generatorType)
+	writeModel := NewInstanceSecretGeneratorConfigWriteModel(ctx, generatorType)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/instance_settings_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/caos/zitadel/internal/crypto"
@@ -58,7 +59,7 @@ func TestCommandSide_AddSecretGenerator(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewSecretGeneratorAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode,
 								4,
 								time.Hour*1,
@@ -95,25 +96,27 @@ func TestCommandSide_AddSecretGenerator(t *testing.T) {
 					expectFilter(),
 					expectPush(
 						[]*repository.Event{
-							eventFromEventPusher(instance.NewSecretGeneratorAddedEvent(
-								context.Background(),
-								&instance.NewAggregate().Aggregate,
-								domain.SecretGeneratorTypeInitCode,
-								4,
-								time.Hour*1,
-								true,
-								true,
-								true,
-								true,
-							),
+							eventFromEventPusherWithInstanceID(
+								"INSTANCE",
+								instance.NewSecretGeneratorAddedEvent(
+									context.Background(),
+									&instance.NewAggregate("INSTANCE").Aggregate,
+									domain.SecretGeneratorTypeInitCode,
+									4,
+									time.Hour*1,
+									true,
+									true,
+									true,
+									true,
+								),
 							),
 						},
-						uniqueConstraintsFromEventConstraint(instance.NewAddSecretGeneratorTypeUniqueConstraint(domain.SecretGeneratorTypeInitCode)),
+						uniqueConstraintsFromEventConstraintWithInstanceID("INSTANCE", instance.NewAddSecretGeneratorTypeUniqueConstraint(domain.SecretGeneratorTypeInitCode)),
 					),
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx: authz.WithInstanceID(context.Background(), "INSTANCE"),
 				generator: &crypto.GeneratorConfig{
 					Length:              4,
 					Expiry:              1 * time.Hour,
@@ -126,7 +129,7 @@ func TestCommandSide_AddSecretGenerator(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -158,6 +161,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 		ctx           context.Context
 		generator     *crypto.GeneratorConfig
 		generatorType domain.SecretGeneratorType
+		instanceID    string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -210,7 +214,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSecretGeneratorAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode,
 								4,
 								time.Hour*1,
@@ -222,7 +226,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewSecretGeneratorRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode),
 						),
 					),
@@ -245,7 +249,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSecretGeneratorAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode,
 								4,
 								time.Hour*1,
@@ -283,7 +287,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSecretGeneratorAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode,
 								4,
 								time.Hour*1,
@@ -324,7 +328,7 @@ func TestCommandSide_ChangeSecretGenerator(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -355,6 +359,7 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 	type args struct {
 		ctx           context.Context
 		generatorType domain.SecretGeneratorType
+		instanceID    string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -406,7 +411,7 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSecretGeneratorAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode,
 								4,
 								time.Hour*1,
@@ -418,7 +423,7 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 						),
 						eventFromEventPusher(
 							instance.NewSecretGeneratorRemovedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode),
 						),
 					),
@@ -441,7 +446,7 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSecretGeneratorAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.SecretGeneratorTypeInitCode,
 								4,
 								time.Hour*1,
@@ -456,7 +461,7 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(
 								instance.NewSecretGeneratorRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									domain.SecretGeneratorTypeInitCode),
 							),
 						},
@@ -470,7 +475,7 @@ func TestCommandSide_RemoveSecretGenerator(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -504,7 +509,7 @@ func newSecretGeneratorChangedEvent(ctx context.Context, generatorType domain.Se
 		instance.ChangeSecretGeneratorIncludeSymbols(symbols),
 	}
 	event, _ := instance.NewSecretGeneratorChangeEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		generatorType,
 		changes,
 	)

internal/command/instance_smtp_config_model.go

@@ -21,11 +21,11 @@ type InstanceSMTPConfigWriteModel struct {
 	State         domain.SMTPConfigState
 }
 
-func NewInstanceSMTPConfigWriteModel() *InstanceSMTPConfigWriteModel {
+func NewInstanceSMTPConfigWriteModel(instanceID string) *InstanceSMTPConfigWriteModel {
 	return &InstanceSMTPConfigWriteModel{
 		WriteModel: eventstore.WriteModel{
-			AggregateID:   domain.IAMID,
-			ResourceOwner: domain.IAMID,
+			AggregateID:   instanceID,
+			ResourceOwner: instanceID,
 		},
 	}
 }

internal/command/key_pair.go

@@ -7,7 +7,7 @@ import (
 	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/crypto"
 	"github.com/caos/zitadel/internal/domain"
-	keypair "github.com/caos/zitadel/internal/repository/keypair"
+	"github.com/caos/zitadel/internal/repository/keypair"
 )
 
 const (
@@ -28,7 +28,8 @@ func (c *Commands) GenerateSigningKeyPair(ctx context.Context, algorithm string)
 	privateKeyExp := time.Now().UTC().Add(c.privateKeyLifetime)
 	publicKeyExp := time.Now().UTC().Add(c.publicKeyLifetime)
 
-	keyPairWriteModel := NewKeyPairWriteModel(keyID, domain.IAMID)
+	//TODO: InstanceID not available here?
+	keyPairWriteModel := NewKeyPairWriteModel(keyID, "system") //TODO: change with multi issuer
 	keyAgg := KeyPairAggregateFromWriteModel(&keyPairWriteModel.WriteModel)
 	_, err = c.eventstore.Push(ctx, keypair.NewAddedEvent(
 		ctx,
@@ -41,5 +42,6 @@ func (c *Commands) GenerateSigningKeyPair(ctx context.Context, algorithm string)
 }
 
 func setOIDCCtx(ctx context.Context) context.Context {
-	return authz.SetCtxData(ctx, authz.CtxData{UserID: oidcUser, OrgID: domain.IAMID})
+	//TODO: InstanceID not available here?
+	return authz.SetCtxData(ctx, authz.CtxData{UserID: oidcUser, OrgID: authz.GetInstance(ctx).InstanceID()})
 }

internal/command/main_test.go

@@ -157,6 +157,26 @@ func eventFromEventPusher(event eventstore.Command) *repository.Event {
 	}
 }
 
+func eventFromEventPusherWithInstanceID(instanceID string, event eventstore.Command) *repository.Event {
+	data, _ := eventstore.EventData(event)
+	return &repository.Event{
+		ID:                            "",
+		Sequence:                      0,
+		PreviousAggregateSequence:     0,
+		PreviousAggregateTypeSequence: 0,
+		CreationDate:                  time.Time{},
+		Type:                          repository.EventType(event.Type()),
+		Data:                          data,
+		EditorService:                 event.EditorService(),
+		EditorUser:                    event.EditorUser(),
+		Version:                       repository.Version(event.Aggregate().Version),
+		AggregateID:                   event.Aggregate().ID,
+		AggregateType:                 repository.AggregateType(event.Aggregate().Type),
+		ResourceOwner:                 sql.NullString{String: event.Aggregate().ResourceOwner, Valid: event.Aggregate().ResourceOwner != ""},
+		InstanceID:                    sql.NullString{String: instanceID, Valid: instanceID != ""},
+	}
+}
+
 func eventFromEventPusherWithCreationDateNow(event eventstore.Command) *repository.Event {
 	e := eventFromEventPusher(event)
 	e.CreationDate = time.Now()
@@ -171,6 +191,15 @@ func uniqueConstraintsFromEventConstraint(constraint *eventstore.EventUniqueCons
 		Action:       repository.UniqueConstraintAction(constraint.Action)}
 }
 
+func uniqueConstraintsFromEventConstraintWithInstanceID(instanceID string, constraint *eventstore.EventUniqueConstraint) *repository.UniqueConstraint {
+	return &repository.UniqueConstraint{
+		InstanceID:   instanceID,
+		UniqueType:   constraint.UniqueType,
+		UniqueField:  constraint.UniqueField,
+		ErrorMessage: constraint.ErrorMessage,
+		Action:       repository.UniqueConstraintAction(constraint.Action)}
+}
+
 func GetMockSecretGenerator(t *testing.T) crypto.Generator {
 	ctrl := gomock.NewController(t)
 	alg := crypto.CreateMockEncryptionAlg(ctrl)

internal/command/org_domain.go

@@ -104,7 +104,7 @@ func (c *Commands) ValidateOrgDomain(ctx context.Context, orgDomain *domain.OrgD
 		for _, userID := range claimedUserIDs {
 			userEvents, _, err := c.userDomainClaimed(ctx, userID)
 			if err != nil {
-				logging.LogWithFields("COMMAND-5m8fs", "userid", userID).WithError(err).Warn("could not claim user")
+				logging.WithFields("userid", userID).WithError(err).Warn("could not claim user")
 				continue
 			}
 			events = append(events, userEvents...)

internal/command/org_features.go

@@ -384,7 +384,7 @@ func (c *Commands) getOrgFeaturesOrDefault(ctx context.Context, orgID string) (*
 		return writeModelToFeatures(&existingFeatures.FeaturesWriteModel), nil
 	}
 
-	existingIAMFeatures := NewInstanceFeaturesWriteModel()
+	existingIAMFeatures := NewInstanceFeaturesWriteModel(ctx)
 	err = c.eventstore.FilterToQueryReducer(ctx, existingIAMFeatures)
 	if err != nil {
 		return nil, err

internal/command/org_features_test.go

@@ -159,7 +159,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -178,7 +178,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -191,7 +191,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -240,7 +240,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -252,7 +252,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -264,7 +264,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helpLink",
@@ -275,7 +275,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								5,
 								false,
 							),
@@ -343,7 +343,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -362,7 +362,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -375,7 +375,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -445,7 +445,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -457,7 +457,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -469,7 +469,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helplink",
@@ -480,7 +480,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								5,
 								false,
 							),
@@ -553,7 +553,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -572,7 +572,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -585,7 +585,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -662,7 +662,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -674,7 +674,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -686,7 +686,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helplink",
@@ -697,7 +697,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								5,
 								false,
 							),
@@ -773,7 +773,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -792,7 +792,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -805,7 +805,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -889,7 +889,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -901,7 +901,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -913,7 +913,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helplink",
@@ -924,7 +924,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								5,
 								false,
 							),
@@ -1008,7 +1008,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -1025,7 +1025,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							org.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -1045,7 +1045,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								true,
 								true,
@@ -1064,10 +1064,10 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 					//orgLoginPolicyAuthFactorsWriteModel
 					expectFilter(
 						eventFromEventPusher(
-							instance.NewLoginPolicySecondFactorAddedEvent(context.Background(), &instance.NewAggregate().Aggregate, domain.SecondFactorTypeU2F),
+							instance.NewLoginPolicySecondFactorAddedEvent(context.Background(), &instance.NewAggregate("INSTANCE").Aggregate, domain.SecondFactorTypeU2F),
 						),
 						eventFromEventPusher(
-							instance.NewLoginPolicyMultiFactorAddedEvent(context.Background(), &instance.NewAggregate().Aggregate, domain.MultiFactorTypeU2FWithPIN),
+							instance.NewLoginPolicyMultiFactorAddedEvent(context.Background(), &instance.NewAggregate("INSTANCE").Aggregate, domain.MultiFactorTypeU2FWithPIN),
 						),
 						eventFromEventPusher(
 							org.NewLoginPolicySecondFactorAddedEvent(context.Background(), &org.NewAggregate("org1", "org1").Aggregate, domain.SecondFactorTypeOTP),
@@ -1085,7 +1085,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -1096,7 +1096,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							org.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								7,
 								false,
 								false,
@@ -1111,7 +1111,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -1128,7 +1128,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							org.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"custom",
 								"secondary",
 								"warn",
@@ -1181,7 +1181,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							org.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -1193,7 +1193,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							org.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -1205,7 +1205,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							org.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helplink",
@@ -1318,7 +1318,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -1337,7 +1337,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -1350,7 +1350,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -1399,7 +1399,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -1411,7 +1411,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -1423,7 +1423,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helplink",
@@ -1434,7 +1434,7 @@ func TestCommandSide_SetOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								5,
 								false,
 							),
@@ -1583,7 +1583,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,
@@ -1602,7 +1602,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								false,
 								false,
@@ -1615,7 +1615,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"primary",
 								"secondary",
 								"warn",
@@ -1664,7 +1664,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.InitCodeMessageType,
 								domain.MessageSubject,
 								"text",
@@ -1676,7 +1676,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewCustomTextSetEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								domain.LoginCustomText,
 								domain.LoginKeyExternalRegistrationUserOverviewTitle,
 								"text",
@@ -1688,7 +1688,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewPrivacyPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"toslink",
 								"privacylink",
 								"helplink",
@@ -1699,7 +1699,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewLockoutPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								5,
 								false,
 							),
@@ -1751,7 +1751,7 @@ func TestCommandSide_RemoveOrgFeatures(t *testing.T) {
 func newIAMFeaturesSetEvent(ctx context.Context, tierName string, state domain.FeaturesState, auditLog time.Duration) *instance.FeaturesSetEvent {
 	event, _ := instance.NewFeaturesSetEvent(
 		ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		[]features.FeaturesChanges{
 			features.ChangeTierName(tierName),
 			features.ChangeState(state),

internal/command/org_policy_label_test.go

@@ -112,7 +112,7 @@ func TestCommandSide_AddLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -160,7 +160,7 @@ func TestCommandSide_AddLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -341,7 +341,7 @@ func TestCommandSide_ChangeLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -406,7 +406,7 @@ func TestCommandSide_ChangeLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",
@@ -471,7 +471,7 @@ func TestCommandSide_ChangeLabelPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLabelPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"#ffffff",
 								"#ffffff",
 								"#ffffff",

internal/command/org_policy_login.go

@@ -432,7 +432,7 @@ func (c *Commands) orgLoginPolicyAuthFactorsWriteModel(ctx context.Context, orgI
 	ctx, span := tracing.NewSpan(ctx)
 	defer func() { span.EndWithError(err) }()
 
-	writeModel := NewOrgAuthFactorsAllowedWriteModel(orgID)
+	writeModel := NewOrgAuthFactorsAllowedWriteModel(ctx, orgID)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/org_policy_login_factors_model.go

@@ -1,6 +1,9 @@
 package command
 
 import (
+	"context"
+
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/eventstore"
 	"github.com/caos/zitadel/internal/repository/instance"
@@ -107,9 +110,10 @@ func (wm *OrgMultiFactorWriteModel) Query() *eventstore.SearchQueryBuilder {
 		Builder()
 }
 
-func NewOrgAuthFactorsAllowedWriteModel(orgID string) *OrgAuthFactorsAllowedWriteModel {
+func NewOrgAuthFactorsAllowedWriteModel(ctx context.Context, orgID string) *OrgAuthFactorsAllowedWriteModel {
 	return &OrgAuthFactorsAllowedWriteModel{
 		WriteModel: eventstore.WriteModel{
+			InstanceID:    authz.GetInstance(ctx).InstanceID(),
 			AggregateID:   orgID,
 			ResourceOwner: orgID,
 		},
@@ -186,7 +190,7 @@ func (wm *OrgAuthFactorsAllowedWriteModel) Query() *eventstore.SearchQueryBuilde
 	return eventstore.NewSearchQueryBuilder(eventstore.ColumnsEvent).
 		AddQuery().
 		AggregateTypes(instance.AggregateType).
-		AggregateIDs(domain.IAMID).
+		AggregateIDs(wm.InstanceID).
 		EventTypes(
 			instance.LoginPolicySecondFactorAddedEventType,
 			instance.LoginPolicySecondFactorRemovedEventType,

internal/command/org_policy_login_test.go

@@ -119,7 +119,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								true,
 								true,
@@ -166,7 +166,7 @@ func TestCommandSide_AddLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								true,
 								true,
@@ -352,7 +352,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								true,
 								true,
@@ -416,7 +416,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								true,
 								true,
@@ -481,7 +481,7 @@ func TestCommandSide_ChangeLoginPolicy(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewLoginPolicyAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								false,
 								false,
 								false,

internal/command/project.go

@@ -38,13 +38,6 @@ func (c *Commands) addProject(ctx context.Context, projectAdd *domain.Project, r
 	projectAgg := ProjectAggregateFromWriteModel(&addedProject.WriteModel)
 
 	projectRole := domain.RoleProjectOwner
-	iam, err := c.GetInstance(ctx)
-	if err != nil {
-		return nil, nil, err
-	}
-	if iam.GlobalOrgID == resourceOwner {
-		projectRole = domain.RoleProjectOwnerGlobal
-	}
 	events := []eventstore.Command{
 		project.NewProjectAddedEvent(
 			ctx,

internal/command/project_test.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"testing"
 
+	id_mock "github.com/caos/zitadel/internal/id/mock"
+	"github.com/caos/zitadel/internal/repository/member"
 	"github.com/stretchr/testify/assert"
 
 	"github.com/caos/zitadel/internal/domain"
@@ -12,9 +14,6 @@ import (
 	"github.com/caos/zitadel/internal/eventstore/repository"
 	"github.com/caos/zitadel/internal/eventstore/v1/models"
 	"github.com/caos/zitadel/internal/id"
-	id_mock "github.com/caos/zitadel/internal/id/mock"
-	"github.com/caos/zitadel/internal/repository/instance"
-	"github.com/caos/zitadel/internal/repository/member"
 	"github.com/caos/zitadel/internal/repository/project"
 )
 
@@ -60,14 +59,6 @@ func TestCommandSide_AddProject(t *testing.T) {
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
-					expectFilter(
-						eventFromEventPusher(
-							instance.NewGlobalOrgSetEventEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
-								"globalorg",
-							),
-						),
-					),
 					expectPushFailed(caos_errs.ThrowAlreadyExists(nil, "ERROR", "internl"),
 						[]*repository.Event{
 							eventFromEventPusher(project.NewProjectAddedEvent(
@@ -107,81 +98,11 @@ func TestCommandSide_AddProject(t *testing.T) {
 				err: caos_errs.IsErrorAlreadyExists,
 			},
 		},
-		{
-			name: "global org with project owner global, ok",
-			fields: fields{
-				eventstore: eventstoreExpect(
-					t,
-					expectFilter(
-						eventFromEventPusher(
-							instance.NewGlobalOrgSetEventEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
-								"globalorg",
-							),
-						),
-					),
-					expectPush(
-						[]*repository.Event{
-							eventFromEventPusher(project.NewProjectAddedEvent(
-								context.Background(),
-								&project.NewAggregate("project1", "globalorg").Aggregate,
-								"project", true, true, true,
-								domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy,
-							),
-							),
-							eventFromEventPusher(project.NewProjectMemberAddedEvent(
-								context.Background(),
-								&project.NewAggregate("project1", "globalorg").Aggregate,
-								"user1",
-								[]string{domain.RoleProjectOwnerGlobal}...,
-							),
-							),
-						},
-						uniqueConstraintsFromEventConstraint(project.NewAddProjectNameUniqueConstraint("project", "globalorg")),
-						uniqueConstraintsFromEventConstraint(member.NewAddMemberUniqueConstraint("project1", "user1")),
-					),
-				),
-				idGenerator: id_mock.NewIDGeneratorExpectIDs(t, "project1"),
-			},
-			args: args{
-				ctx: context.Background(),
-				project: &domain.Project{
-					Name:                   "project",
-					ProjectRoleAssertion:   true,
-					ProjectRoleCheck:       true,
-					HasProjectCheck:        true,
-					PrivateLabelingSetting: domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy,
-				},
-				resourceOwner: "globalorg",
-				ownerID:       "user1",
-			},
-			res: res{
-				want: &domain.Project{
-					ObjectRoot: models.ObjectRoot{
-						ResourceOwner: "globalorg",
-						AggregateID:   "project1",
-					},
-					Name:                   "project",
-					ProjectRoleAssertion:   true,
-					ProjectRoleCheck:       true,
-					HasProjectCheck:        true,
-					PrivateLabelingSetting: domain.PrivateLabelingSettingAllowLoginUserResourceOwnerPolicy,
-				},
-			},
-		},
 		{
 			name: "org with project owner, ok",
 			fields: fields{
 				eventstore: eventstoreExpect(
 					t,
-					expectFilter(
-						eventFromEventPusher(
-							instance.NewGlobalOrgSetEventEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
-								"globalorg",
-							),
-						),
-					),
 					expectPush(
 						[]*repository.Event{
 							eventFromEventPusher(project.NewProjectAddedEvent(

internal/command/setup.go

@@ -1,105 +0,0 @@
-package command
-
-import (
-	"context"
-
-	"github.com/caos/logging"
-	"github.com/caos/zitadel/internal/eventstore"
-
-	"github.com/caos/zitadel/internal/api/authz"
-	"github.com/caos/zitadel/internal/domain"
-	caos_errs "github.com/caos/zitadel/internal/errors"
-	"github.com/caos/zitadel/internal/eventstore/v1/models"
-	iam_repo "github.com/caos/zitadel/internal/repository/instance"
-)
-
-type Step interface {
-	Step() domain.Step
-	execute(context.Context, *Commands) error
-}
-
-const (
-	SetupUser = "SETUP"
-)
-
-func (c *Commands) ExecuteSetupSteps(ctx context.Context, steps []Step) error {
-	iam, err := c.GetInstance(ctx)
-	if err != nil && !caos_errs.IsNotFound(err) {
-		return err
-	}
-	if iam != nil && (iam.SetUpDone == domain.StepCount-1 || iam.SetUpStarted != iam.SetUpDone) {
-		logging.Log("COMMA-dgd2z").Info("all steps done")
-		return nil
-	}
-
-	if iam == nil {
-		iam = &domain.Instance{ObjectRoot: models.ObjectRoot{}}
-	}
-
-	ctx = setSetUpContextData(ctx)
-
-	for _, step := range steps {
-		iam, err = c.StartSetup(ctx, step.Step())
-		if err != nil {
-			return err
-		}
-
-		err = step.execute(ctx, c)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func setSetUpContextData(ctx context.Context) context.Context {
-	return authz.SetCtxData(ctx, authz.CtxData{UserID: SetupUser})
-}
-
-func (c *Commands) StartSetup(ctx context.Context, step domain.Step) (*domain.Instance, error) {
-	logging.Log("COMMA-3M9fs").Infof("start setup step %v", step)
-	iamWriteModel, err := c.getIAMWriteModel(ctx)
-	if err != nil && !caos_errs.IsNotFound(err) {
-		return nil, err
-	}
-	if iamWriteModel.SetUpStarted >= step || iamWriteModel.SetUpStarted != iamWriteModel.SetUpDone {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-9so34", "setup error")
-	}
-	aggregate := InstanceAggregateFromWriteModel(&iamWriteModel.WriteModel)
-	pushedEvents, err := c.eventstore.Push(ctx, iam_repo.NewSetupStepStartedEvent(ctx, aggregate, step))
-	if err != nil {
-		return nil, caos_errs.ThrowPreconditionFailed(nil, "EVENT-Grgh1", "Setup start failed")
-	}
-	err = AppendAndReduce(iamWriteModel, pushedEvents...)
-	if err != nil {
-		return nil, err
-	}
-	logging.LogWithFields("SETUP-fhh21", "step", step).Info("setup step started")
-	return writeModelToInstance(iamWriteModel), nil
-}
-
-func (c *Commands) setup(ctx context.Context, step Step, iamAggregateProvider func(*InstanceWriteModel) ([]eventstore.Command, error)) error {
-	iam, err := c.getIAMWriteModel(ctx)
-	if err != nil && !caos_errs.IsNotFound(err) {
-		return err
-	}
-	if iam.SetUpStarted != step.Step() && iam.SetUpDone+1 != step.Step() {
-		return caos_errs.ThrowPreconditionFailed(nil, "EVENT-Dge32", "wrong step")
-	}
-	events, err := iamAggregateProvider(iam)
-	if err != nil {
-		return err
-	}
-	iamAgg := InstanceAggregateFromWriteModel(&iam.WriteModel)
-	events = append(events, iam_repo.NewSetupStepDoneEvent(ctx, iamAgg, step.Step()))
-
-	_, err = c.eventstore.Push(ctx, events...)
-	if caos_errs.IsErrorAlreadyExists(err) {
-		logging.LogWithFields("SETUP-4M9gsf", "step", step.Step()).WithError(err).Info("setup step already done")
-	}
-	if err != nil {
-		return caos_errs.ThrowPreconditionFailedf(nil, "EVENT-dbG31", "Setup %v failed", step.Step())
-	}
-	logging.LogWithFields("SETUP-Sg1t1", "step", step.Step()).Info("setup step done")
-	return nil
-}

internal/command/sms_config.go

@@ -10,12 +10,12 @@ import (
 	"github.com/caos/zitadel/internal/repository/instance"
 )
 
-func (c *Commands) AddSMSConfigTwilio(ctx context.Context, config *twilio.TwilioConfig) (string, *domain.ObjectDetails, error) {
+func (c *Commands) AddSMSConfigTwilio(ctx context.Context, instanceID string, config *twilio.TwilioConfig) (string, *domain.ObjectDetails, error) {
 	id, err := c.idGenerator.Next()
 	if err != nil {
 		return "", nil, err
 	}
-	smsConfigWriteModel, err := c.getSMSConfig(ctx, id)
+	smsConfigWriteModel, err := c.getSMSConfig(ctx, instanceID, id)
 	if err != nil {
 		return "", nil, err
 	}
@@ -46,11 +46,11 @@ func (c *Commands) AddSMSConfigTwilio(ctx context.Context, config *twilio.Twilio
 	return id, writeModelToObjectDetails(&smsConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) ChangeSMSConfigTwilio(ctx context.Context, id string, config *twilio.TwilioConfig) (*domain.ObjectDetails, error) {
+func (c *Commands) ChangeSMSConfigTwilio(ctx context.Context, instanceID, id string, config *twilio.TwilioConfig) (*domain.ObjectDetails, error) {
 	if id == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "SMS-e9jwf", "Errors.IDMissing")
 	}
-	smsConfigWriteModel, err := c.getSMSConfig(ctx, id)
+	smsConfigWriteModel, err := c.getSMSConfig(ctx, instanceID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -82,8 +82,8 @@ func (c *Commands) ChangeSMSConfigTwilio(ctx context.Context, id string, config
 	return writeModelToObjectDetails(&smsConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) ChangeSMSConfigTwilioToken(ctx context.Context, id, token string) (*domain.ObjectDetails, error) {
-	smsConfigWriteModel, err := c.getSMSConfig(ctx, id)
+func (c *Commands) ChangeSMSConfigTwilioToken(ctx context.Context, instanceID, id, token string) (*domain.ObjectDetails, error) {
+	smsConfigWriteModel, err := c.getSMSConfig(ctx, instanceID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -110,11 +110,11 @@ func (c *Commands) ChangeSMSConfigTwilioToken(ctx context.Context, id, token str
 	return writeModelToObjectDetails(&smsConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) ActivateSMSConfigTwilio(ctx context.Context, id string) (*domain.ObjectDetails, error) {
+func (c *Commands) ActivateSMSConfigTwilio(ctx context.Context, instanceID, id string) (*domain.ObjectDetails, error) {
 	if id == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "SMS-dn93n", "Errors.IDMissing")
 	}
-	smsConfigWriteModel, err := c.getSMSConfig(ctx, id)
+	smsConfigWriteModel, err := c.getSMSConfig(ctx, instanceID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -140,11 +140,11 @@ func (c *Commands) ActivateSMSConfigTwilio(ctx context.Context, id string) (*dom
 	return writeModelToObjectDetails(&smsConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) DeactivateSMSConfigTwilio(ctx context.Context, id string) (*domain.ObjectDetails, error) {
+func (c *Commands) DeactivateSMSConfigTwilio(ctx context.Context, instanceID, id string) (*domain.ObjectDetails, error) {
 	if id == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "SMS-frkwf", "Errors.IDMissing")
 	}
-	smsConfigWriteModel, err := c.getSMSConfig(ctx, id)
+	smsConfigWriteModel, err := c.getSMSConfig(ctx, instanceID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -170,11 +170,11 @@ func (c *Commands) DeactivateSMSConfigTwilio(ctx context.Context, id string) (*d
 	return writeModelToObjectDetails(&smsConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) RemoveSMSConfigTwilio(ctx context.Context, id string) (*domain.ObjectDetails, error) {
+func (c *Commands) RemoveSMSConfigTwilio(ctx context.Context, instanceID, id string) (*domain.ObjectDetails, error) {
 	if id == "" {
 		return nil, caos_errs.ThrowInvalidArgument(nil, "SMS-3j9fs", "Errors.IDMissing")
 	}
-	smsConfigWriteModel, err := c.getSMSConfig(ctx, id)
+	smsConfigWriteModel, err := c.getSMSConfig(ctx, instanceID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -196,8 +196,8 @@ func (c *Commands) RemoveSMSConfigTwilio(ctx context.Context, id string) (*domai
 	}
 	return writeModelToObjectDetails(&smsConfigWriteModel.WriteModel), nil
 }
-func (c *Commands) getSMSConfig(ctx context.Context, id string) (_ *IAMSMSConfigWriteModel, err error) {
-	writeModel := NewIAMSMSConfigWriteModel(id)
+func (c *Commands) getSMSConfig(ctx context.Context, instanceID, id string) (_ *IAMSMSConfigWriteModel, err error) {
+	writeModel := NewIAMSMSConfigWriteModel(instanceID, id)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/sms_config_model.go

@@ -23,11 +23,11 @@ type TwilioConfig struct {
 	SenderNumber string
 }
 
-func NewIAMSMSConfigWriteModel(id string) *IAMSMSConfigWriteModel {
+func NewIAMSMSConfigWriteModel(instanceID, id string) *IAMSMSConfigWriteModel {
 	return &IAMSMSConfigWriteModel{
 		WriteModel: eventstore.WriteModel{
-			AggregateID:   domain.IAMID,
-			ResourceOwner: domain.IAMID,
+			AggregateID:   instanceID,
+			ResourceOwner: instanceID,
 		},
 		ID: id,
 	}

internal/command/sms_config_test.go

@@ -24,8 +24,9 @@ func TestCommandSide_AddSMSConfigTwilio(t *testing.T) {
 		alg         crypto.EncryptionAlgorithm
 	}
 	type args struct {
-		ctx context.Context
-		sms *twilio.TwilioConfig
+		ctx        context.Context
+		instanceID string
+		sms        *twilio.TwilioConfig
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -47,7 +48,7 @@ func TestCommandSide_AddSMSConfigTwilio(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(instance.NewSMSConfigTwilioAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 								"sid",
 								"senderName",
@@ -66,7 +67,8 @@ func TestCommandSide_AddSMSConfigTwilio(t *testing.T) {
 				alg:         crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				sms: &twilio.TwilioConfig{
 					SID:          "sid",
 					Token:        "token",
@@ -75,7 +77,7 @@ func TestCommandSide_AddSMSConfigTwilio(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -87,7 +89,7 @@ func TestCommandSide_AddSMSConfigTwilio(t *testing.T) {
 				idGenerator: tt.fields.idGenerator,
 				smsCrypto:   tt.fields.alg,
 			}
-			_, got, err := r.AddSMSConfigTwilio(tt.args.ctx, tt.args.sms)
+			_, got, err := r.AddSMSConfigTwilio(tt.args.ctx, tt.args.instanceID, tt.args.sms)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -106,9 +108,10 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx context.Context
-		id  string
-		sms *twilio.TwilioConfig
+		ctx        context.Context
+		instanceID string
+		id         string
+		sms        *twilio.TwilioConfig
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -144,9 +147,10 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				sms: &twilio.TwilioConfig{},
-				id:  "id",
+				ctx:        context.Background(),
+				sms:        &twilio.TwilioConfig{},
+				instanceID: "INSTANCE",
+				id:         "id",
 			},
 			res: res{
 				err: caos_errs.IsNotFound,
@@ -161,7 +165,7 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMSConfigTwilioAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 								"sid",
 								"senderName",
@@ -183,7 +187,8 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 					Token:        "token",
 					SenderNumber: "senderName",
 				},
-				id: "providerid",
+				instanceID: "INSTANCE",
+				id:         "providerid",
 			},
 			res: res{
 				err: caos_errs.IsPreconditionFailed,
@@ -198,7 +203,7 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMSConfigTwilioAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 								"sid",
 								"token",
@@ -232,11 +237,12 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 					Token:        "token2",
 					SenderNumber: "senderName2",
 				},
-				id: "providerid",
+				instanceID: "INSTANCE",
+				id:         "providerid",
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -246,7 +252,7 @@ func TestCommandSide_ChangeSMSConfigTwilio(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore,
 			}
-			got, err := r.ChangeSMSConfigTwilio(tt.args.ctx, tt.args.id, tt.args.sms)
+			got, err := r.ChangeSMSConfigTwilio(tt.args.ctx, tt.args.instanceID, tt.args.id, tt.args.sms)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -265,8 +271,9 @@ func TestCommandSide_ActivateSMSConfigTwilio(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx context.Context
-		id  string
+		ctx        context.Context
+		instanceID string
+		id         string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -301,8 +308,9 @@ func TestCommandSide_ActivateSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				id:  "id",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				id:         "id",
 			},
 			res: res{
 				err: caos_errs.IsNotFound,
@@ -317,7 +325,7 @@ func TestCommandSide_ActivateSMSConfigTwilio(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMSConfigTwilioAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 								"sid",
 								"sender-name",
@@ -330,7 +338,7 @@ func TestCommandSide_ActivateSMSConfigTwilio(t *testing.T) {
 							eventFromEventPusher(
 								instance.NewSMSConfigTwilioActivatedEvent(
 									context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"providerid",
 								),
 							),
@@ -339,12 +347,13 @@ func TestCommandSide_ActivateSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				id:  "providerid",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				id:         "providerid",
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -354,7 +363,7 @@ func TestCommandSide_ActivateSMSConfigTwilio(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore,
 			}
-			got, err := r.ActivateSMSConfigTwilio(tt.args.ctx, tt.args.id)
+			got, err := r.ActivateSMSConfigTwilio(tt.args.ctx, tt.args.instanceID, tt.args.id)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -373,8 +382,9 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx context.Context
-		id  string
+		ctx        context.Context
+		instanceID string
+		id         string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -409,8 +419,9 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				id:  "id",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				id:         "id",
 			},
 			res: res{
 				err: caos_errs.IsNotFound,
@@ -425,7 +436,7 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMSConfigTwilioAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 								"sid",
 								"sender-name",
@@ -435,7 +446,7 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMSConfigTwilioActivatedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 							),
 						),
@@ -445,7 +456,7 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 							eventFromEventPusher(
 								instance.NewSMSConfigDeactivatedEvent(
 									context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"providerid",
 								),
 							),
@@ -454,12 +465,13 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				id:  "providerid",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				id:         "providerid",
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -469,7 +481,7 @@ func TestCommandSide_DeactivateSMSConfigTwilio(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore,
 			}
-			got, err := r.DeactivateSMSConfigTwilio(tt.args.ctx, tt.args.id)
+			got, err := r.DeactivateSMSConfigTwilio(tt.args.ctx, tt.args.instanceID, tt.args.id)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -488,8 +500,9 @@ func TestCommandSide_RemoveSMSConfigTwilio(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx context.Context
-		id  string
+		ctx        context.Context
+		instanceID string
+		id         string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -524,8 +537,9 @@ func TestCommandSide_RemoveSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				id:  "id",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				id:         "id",
 			},
 			res: res{
 				err: caos_errs.IsNotFound,
@@ -540,7 +554,7 @@ func TestCommandSide_RemoveSMSConfigTwilio(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMSConfigTwilioAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								"providerid",
 								"sid",
 								"sender-name",
@@ -553,7 +567,7 @@ func TestCommandSide_RemoveSMSConfigTwilio(t *testing.T) {
 							eventFromEventPusher(
 								instance.NewSMSConfigRemovedEvent(
 									context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"providerid",
 								),
 							),
@@ -562,12 +576,13 @@ func TestCommandSide_RemoveSMSConfigTwilio(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
-				id:  "providerid",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				id:         "providerid",
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -577,7 +592,7 @@ func TestCommandSide_RemoveSMSConfigTwilio(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore,
 			}
-			got, err := r.RemoveSMSConfigTwilio(tt.args.ctx, tt.args.id)
+			got, err := r.RemoveSMSConfigTwilio(tt.args.ctx, tt.args.instanceID, tt.args.id)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -597,7 +612,7 @@ func newSMSConfigTwilioChangedEvent(ctx context.Context, id, sid, senderName str
 		instance.ChangeSMSConfigTwilioSenderNumber(senderName),
 	}
 	event, _ := instance.NewSMSConfigTwilioChangedEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		id,
 		changes,
 	)

internal/command/smtp.go

@@ -10,8 +10,8 @@ import (
 	"github.com/caos/zitadel/internal/repository/instance"
 )
 
-func (c *Commands) AddSMTPConfig(ctx context.Context, config *smtp.EmailConfig) (*domain.ObjectDetails, error) {
-	smtpConfigWriteModel, err := c.getSMTPConfig(ctx)
+func (c *Commands) AddSMTPConfig(ctx context.Context, instanceID string, config *smtp.EmailConfig) (*domain.ObjectDetails, error) {
+	smtpConfigWriteModel, err := c.getSMTPConfig(ctx, instanceID)
 	if err != nil {
 		return nil, err
 	}
@@ -46,8 +46,8 @@ func (c *Commands) AddSMTPConfig(ctx context.Context, config *smtp.EmailConfig)
 	return writeModelToObjectDetails(&smtpConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) ChangeSMTPConfig(ctx context.Context, config *smtp.EmailConfig) (*domain.ObjectDetails, error) {
-	smtpConfigWriteModel, err := c.getSMTPConfig(ctx)
+func (c *Commands) ChangeSMTPConfig(ctx context.Context, instanceID string, config *smtp.EmailConfig) (*domain.ObjectDetails, error) {
+	smtpConfigWriteModel, err := c.getSMTPConfig(ctx, instanceID)
 	if err != nil {
 		return nil, err
 	}
@@ -81,8 +81,8 @@ func (c *Commands) ChangeSMTPConfig(ctx context.Context, config *smtp.EmailConfi
 	return writeModelToObjectDetails(&smtpConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) ChangeSMTPConfigPassword(ctx context.Context, password string) (*domain.ObjectDetails, error) {
-	smtpConfigWriteModel, err := c.getSMTPConfig(ctx)
+func (c *Commands) ChangeSMTPConfigPassword(ctx context.Context, instanceID, password string) (*domain.ObjectDetails, error) {
+	smtpConfigWriteModel, err := c.getSMTPConfig(ctx, instanceID)
 	if err != nil {
 		return nil, err
 	}
@@ -108,8 +108,8 @@ func (c *Commands) ChangeSMTPConfigPassword(ctx context.Context, password string
 	return writeModelToObjectDetails(&smtpConfigWriteModel.WriteModel), nil
 }
 
-func (c *Commands) getSMTPConfig(ctx context.Context) (_ *InstanceSMTPConfigWriteModel, err error) {
-	writeModel := NewInstanceSMTPConfigWriteModel()
+func (c *Commands) getSMTPConfig(ctx context.Context, instanceID string) (_ *InstanceSMTPConfigWriteModel, err error) {
+	writeModel := NewInstanceSMTPConfigWriteModel(instanceID)
 	err = c.eventstore.FilterToQueryReducer(ctx, writeModel)
 	if err != nil {
 		return nil, err

internal/command/smtp_test.go

@@ -22,8 +22,9 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 		alg        crypto.EncryptionAlgorithm
 	}
 	type args struct {
-		ctx  context.Context
-		smtp *smtp.EmailConfig
+		ctx        context.Context
+		instanceID string
+		smtp       *smtp.EmailConfig
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -43,7 +44,7 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 					expectFilter(
 						eventFromEventPusher(
 							instance.NewSMTPConfigAddedEvent(context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								"from",
 								"name",
@@ -56,7 +57,8 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				smtp: &smtp.EmailConfig{
 					Tls: true,
 				},
@@ -75,7 +77,7 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(instance.NewSMTPConfigAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								"from",
 								"name",
@@ -95,7 +97,8 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 				alg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				smtp: &smtp.EmailConfig{
 					Tls:      true,
 					From:     "from",
@@ -109,7 +112,7 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -120,7 +123,7 @@ func TestCommandSide_AddSMTPConfig(t *testing.T) {
 				eventstore:         tt.fields.eventstore,
 				smtpPasswordCrypto: tt.fields.alg,
 			}
-			got, err := r.AddSMTPConfig(tt.args.ctx, tt.args.smtp)
+			got, err := r.AddSMTPConfig(tt.args.ctx, tt.args.instanceID, tt.args.smtp)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -139,8 +142,9 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 		eventstore *eventstore.Eventstore
 	}
 	type args struct {
-		ctx  context.Context
-		smtp *smtp.EmailConfig
+		ctx        context.Context
+		instanceID string
+		smtp       *smtp.EmailConfig
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -178,7 +182,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMTPConfigAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								"from",
 								"name",
@@ -191,7 +195,8 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 				),
 			},
 			args: args{
-				ctx: context.Background(),
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
 				smtp: &smtp.EmailConfig{
 					Tls:      true,
 					From:     "from",
@@ -215,7 +220,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMTPConfigAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								"from",
 								"name",
@@ -255,7 +260,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -265,7 +270,7 @@ func TestCommandSide_ChangeSMTPConfig(t *testing.T) {
 			r := &Commands{
 				eventstore: tt.fields.eventstore,
 			}
-			got, err := r.ChangeSMTPConfig(tt.args.ctx, tt.args.smtp)
+			got, err := r.ChangeSMTPConfig(tt.args.ctx, tt.args.instanceID, tt.args.smtp)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -285,8 +290,9 @@ func TestCommandSide_ChangeSMTPConfigPassword(t *testing.T) {
 		alg        crypto.EncryptionAlgorithm
 	}
 	type args struct {
-		ctx      context.Context
-		password string
+		ctx        context.Context
+		instanceID string
+		password   string
 	}
 	type res struct {
 		want *domain.ObjectDetails
@@ -323,7 +329,7 @@ func TestCommandSide_ChangeSMTPConfigPassword(t *testing.T) {
 						eventFromEventPusher(
 							instance.NewSMTPConfigAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 								"from",
 								"name",
@@ -337,7 +343,7 @@ func TestCommandSide_ChangeSMTPConfigPassword(t *testing.T) {
 						[]*repository.Event{
 							eventFromEventPusher(instance.NewSMTPConfigPasswordChangedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								&crypto.CryptoValue{
 									CryptoType: crypto.TypeEncryption,
 									Algorithm:  "enc",
@@ -352,12 +358,13 @@ func TestCommandSide_ChangeSMTPConfigPassword(t *testing.T) {
 				alg: crypto.CreateMockEncryptionAlg(gomock.NewController(t)),
 			},
 			args: args{
-				ctx:      context.Background(),
-				password: "password",
+				ctx:        context.Background(),
+				instanceID: "INSTANCE",
+				password:   "password",
 			},
 			res: res{
 				want: &domain.ObjectDetails{
-					ResourceOwner: "IAM",
+					ResourceOwner: "INSTANCE",
 				},
 			},
 		},
@@ -368,7 +375,7 @@ func TestCommandSide_ChangeSMTPConfigPassword(t *testing.T) {
 				eventstore:         tt.fields.eventstore,
 				smtpPasswordCrypto: tt.fields.alg,
 			}
-			got, err := r.ChangeSMTPConfigPassword(tt.args.ctx, tt.args.password)
+			got, err := r.ChangeSMTPConfigPassword(tt.args.ctx, tt.args.instanceID, tt.args.password)
 			if tt.res.err == nil {
 				assert.NoError(t, err)
 			}
@@ -391,7 +398,7 @@ func newSMTPConfigChangedEvent(ctx context.Context, tls bool, fromAddress, fromN
 		instance.ChangeSMTPConfigSMTPUser(user),
 	}
 	event, _ := instance.NewSMTPConfigChangeEvent(ctx,
-		&instance.NewAggregate().Aggregate,
+		&instance.NewAggregate("INSTANCE").Aggregate,
 		changes,
 	)
 	return event

internal/command/user.go

@@ -197,7 +197,7 @@ func (c *Commands) RemoveUser(ctx context.Context, userID, resourceOwner string,
 	for _, grantID := range cascadingGrantIDs {
 		removeEvent, _, err := c.removeUserGrant(ctx, grantID, "", true)
 		if err != nil {
-			logging.LogWithFields("COMMAND-5m9oL", "usergrantid", grantID).WithError(err).Warn("could not cascade remove role on user grant")
+			logging.WithFields("usergrantid", grantID).WithError(err).Warn("could not cascade remove role on user grant")
 			continue
 		}
 		events = append(events, removeEvent)

internal/command/user_human_init.go

@@ -69,7 +69,7 @@ func (c *Commands) HumanVerifyInitCode(ctx context.Context, userID, resourceOwne
 	err = crypto.VerifyCode(existingCode.CodeCreationDate, existingCode.CodeExpiry, existingCode.Code, code, initCodeGenerator)
 	if err != nil {
 		_, err = c.eventstore.Push(ctx, user.NewHumanInitializedCheckFailedEvent(ctx, userAgg))
-		logging.LogWithFields("COMMAND-Dg2z5", "userID", userAgg.ID).OnError(err).Error("NewHumanInitializedCheckFailedEvent push failed")
+		logging.WithFields("userID", userAgg.ID).OnError(err).Error("NewHumanInitializedCheckFailedEvent push failed")
 		return caos_errs.ThrowInvalidArgument(err, "COMMAND-11v6G", "Errors.User.Code.Invalid")
 	}
 	events := []eventstore.Command{

internal/command/user_membership.go

@@ -14,7 +14,7 @@ func (c *Commands) removeUserMemberships(ctx context.Context, memberships []*que
 	events := make([]eventstore.Command, 0)
 	for _, membership := range memberships {
 		if membership.IAM != nil {
-			iamAgg := instance.NewAggregate()
+			iamAgg := instance.NewAggregate(membership.IAM.IAMID)
 			removeEvent := c.removeInstanceMember(ctx, &iamAgg.Aggregate, membership.UserID, true)
 			events = append(events, removeEvent)
 		} else if membership.Org != nil {

internal/command/user_test.go

@@ -5,6 +5,9 @@ import (
 	"testing"
 	"time"
 
+	"github.com/caos/zitadel/internal/repository/member"
+	"github.com/caos/zitadel/internal/repository/org"
+	"github.com/caos/zitadel/internal/repository/project"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/text/language"
 
@@ -15,9 +18,6 @@ import (
 	"github.com/caos/zitadel/internal/id"
 	"github.com/caos/zitadel/internal/query"
 	"github.com/caos/zitadel/internal/repository/instance"
-	"github.com/caos/zitadel/internal/repository/member"
-	"github.com/caos/zitadel/internal/repository/org"
-	"github.com/caos/zitadel/internal/repository/project"
 	"github.com/caos/zitadel/internal/repository/user"
 )
 
@@ -919,6 +919,7 @@ func TestCommandSide_RemoveUser(t *testing.T) {
 	type (
 		args struct {
 			ctx                    context.Context
+			instanceID             string
 			orgID                  string
 			userID                 string
 			cascadeUserMemberships []*query.Membership
@@ -1165,7 +1166,7 @@ func TestCommandSide_RemoveUser(t *testing.T) {
 							),
 							eventFromEventPusher(
 								instance.NewMemberCascadeRemovedEvent(context.Background(),
-									&instance.NewAggregate().Aggregate,
+									&instance.NewAggregate("INSTANCE").Aggregate,
 									"user1",
 								),
 							),
@@ -1190,7 +1191,7 @@ func TestCommandSide_RemoveUser(t *testing.T) {
 							),
 						},
 						uniqueConstraintsFromEventConstraint(user.NewRemoveUsernameUniqueConstraint("username", "org1", true)),
-						uniqueConstraintsFromEventConstraint(member.NewRemoveMemberUniqueConstraint(domain.IAMID, "user1")),
+						uniqueConstraintsFromEventConstraint(member.NewRemoveMemberUniqueConstraint("INSTANCE", "user1")),
 						uniqueConstraintsFromEventConstraint(member.NewRemoveMemberUniqueConstraint("org1", "user1")),
 						uniqueConstraintsFromEventConstraint(member.NewRemoveMemberUniqueConstraint("project1", "user1")),
 						uniqueConstraintsFromEventConstraint(project.NewRemoveProjectGrantMemberUniqueConstraint("project1", "user1", "grant1")),
@@ -1204,7 +1205,7 @@ func TestCommandSide_RemoveUser(t *testing.T) {
 				cascadeUserMemberships: []*query.Membership{
 					{
 						IAM: &query.IAMMembership{
-							IAMID: "IAM",
+							IAMID: "INSTANCE",
 						},
 						UserID:        "user1",
 						ResourceOwner: "org1",

internal/command/v2/instance.go

@@ -142,12 +142,11 @@ func (s *InstanceSetup) generateIDs() (err error) {
 }
 
 func (command *Command) SetUpInstance(ctx context.Context, setup *InstanceSetup) (*domain.ObjectDetails, error) {
-	// TODO
-	// instanceID, err := id.SonyFlakeGenerator.Next()
-	// if err != nil {
-	// 	return nil, err
-	// }
-	ctx = authz.SetCtxData(authz.WithInstanceID(ctx, "system"), authz.CtxData{OrgID: domain.IAMID, ResourceOwner: domain.IAMID})
+	instanceID, err := id.SonyFlakeGenerator.Next()
+	if err != nil {
+		return nil, err
+	}
+	ctx = authz.SetCtxData(authz.WithInstanceID(ctx, instanceID), authz.CtxData{OrgID: instanceID, ResourceOwner: instanceID})
 
 	orgID, err := id.SonyFlakeGenerator.Next()
 	if err != nil {
@@ -165,7 +164,7 @@ func (command *Command) SetUpInstance(ctx context.Context, setup *InstanceSetup)
 
 	setup.Org.Human.PasswordChangeRequired = true
 
-	instanceAgg := instance.NewAggregate()
+	instanceAgg := instance.NewAggregate(instanceID)
 	orgAgg := org.NewAggregate(orgID, orgID)
 	userAgg := user.NewAggregate(userID, orgID)
 	projectAgg := project.NewAggregate(setup.Zitadel.projectID, orgID)

internal/command/v2/instance_email_template.go

@@ -96,7 +96,7 @@ func SetInstanceCustomTexts(
 }
 
 func existingInstanceCustomMessageText(ctx context.Context, filter preparation.FilterToQueryReducer, textType string, lang language.Tag) (*command.InstanceCustomMessageTextWriteModel, error) {
-	writeModel := command.NewInstanceCustomMessageTextWriteModel(textType, lang)
+	writeModel := command.NewInstanceCustomMessageTextWriteModel(ctx, textType, lang)
 	events, err := filter(ctx, writeModel.Query())
 	if err != nil {
 		return nil, err

internal/command/v2/user_domain_policy.go

@@ -36,7 +36,7 @@ func orgDomainPolicy(ctx context.Context, filter preparation.FilterToQueryReduce
 }
 
 func instanceDomainPolicy(ctx context.Context, filter preparation.FilterToQueryReducer) (*command.PolicyDomainWriteModel, error) {
-	policy := command.NewInstanceDomainPolicyWriteModel()
+	policy := command.NewInstanceDomainPolicyWriteModel(ctx)
 	events, err := filter(ctx, policy.Query())
 	if err != nil {
 		return nil, err

internal/command/v2/user_domain_policy_test.go

@@ -5,6 +5,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/command"
 	"github.com/caos/zitadel/internal/command/v2/preparation"
 	"github.com/caos/zitadel/internal/domain"
@@ -120,7 +121,7 @@ func Test_defaultDomainPolicy(t *testing.T) {
 					return []eventstore.Event{
 						instance.NewDomainPolicyAddedEvent(
 							context.Background(),
-							&instance.NewAggregate().Aggregate,
+							&instance.NewAggregate("INSTANCE").Aggregate,
 							true,
 						),
 					}, nil
@@ -128,8 +129,8 @@ func Test_defaultDomainPolicy(t *testing.T) {
 			},
 			want: &command.PolicyDomainWriteModel{
 				WriteModel: eventstore.WriteModel{
-					AggregateID:   "IAM",
-					ResourceOwner: "IAM",
+					AggregateID:   "INSTANCE",
+					ResourceOwner: "INSTANCE",
 					Events:        []eventstore.Event{},
 				},
 				UserLoginMustBeDomain: true,
@@ -140,7 +141,7 @@ func Test_defaultDomainPolicy(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := instanceDomainPolicy(context.Background(), tt.args.filter)
+			got, err := instanceDomainPolicy(authz.WithInstanceID(context.Background(), "INSTANCE"), tt.args.filter)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("defaultDomainPolicy() error = %v, wantErr %v", err, tt.wantErr)
 				return
@@ -222,7 +223,7 @@ func Test_DomainPolicy(t *testing.T) {
 						return []eventstore.Event{
 							instance.NewDomainPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								true,
 							),
 						}, nil
@@ -231,8 +232,8 @@ func Test_DomainPolicy(t *testing.T) {
 			},
 			want: &command.PolicyDomainWriteModel{
 				WriteModel: eventstore.WriteModel{
-					AggregateID:   "IAM",
-					ResourceOwner: "IAM",
+					AggregateID:   "INSTANCE",
+					ResourceOwner: "INSTANCE",
 					Events:        []eventstore.Event{},
 				},
 				UserLoginMustBeDomain: true,
@@ -253,7 +254,7 @@ func Test_DomainPolicy(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := domainPolicyWriteModel(context.Background(), tt.args.filter)
+			got, err := domainPolicyWriteModel(authz.WithInstanceID(context.Background(), "INSTANCE"), tt.args.filter)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("defaultDomainPolicy() error = %v, wantErr %v", err, tt.wantErr)
 				return

internal/command/v2/user_password_complexity_policy.go

@@ -36,7 +36,7 @@ func customPasswordComplexityPolicy(ctx context.Context, filter preparation.Filt
 }
 
 func defaultPasswordComplexityPolicy(ctx context.Context, filter preparation.FilterToQueryReducer) (*command.PasswordComplexityPolicyWriteModel, error) {
-	policy := command.NewInstancePasswordComplexityPolicyWriteModel()
+	policy := command.NewInstancePasswordComplexityPolicyWriteModel(ctx)
 	events, err := filter(ctx, policy.Query())
 	if err != nil {
 		return nil, err

internal/command/v2/user_password_complexity_policy_test.go

@@ -5,6 +5,7 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/caos/zitadel/internal/api/authz"
 	"github.com/caos/zitadel/internal/command"
 	"github.com/caos/zitadel/internal/command/v2/preparation"
 	"github.com/caos/zitadel/internal/domain"
@@ -128,7 +129,7 @@ func Test_defaultPasswordComplexityPolicy(t *testing.T) {
 					return []eventstore.Event{
 						instance.NewPasswordComplexityPolicyAddedEvent(
 							context.Background(),
-							&instance.NewAggregate().Aggregate,
+							&instance.NewAggregate("INSTANCE").Aggregate,
 							8,
 							true,
 							true,
@@ -140,8 +141,8 @@ func Test_defaultPasswordComplexityPolicy(t *testing.T) {
 			},
 			want: &command.PasswordComplexityPolicyWriteModel{
 				WriteModel: eventstore.WriteModel{
-					AggregateID:   "IAM",
-					ResourceOwner: "IAM",
+					AggregateID:   "INSTANCE",
+					ResourceOwner: "INSTANCE",
 					Events:        []eventstore.Event{},
 				},
 				MinLength:    8,
@@ -156,7 +157,7 @@ func Test_defaultPasswordComplexityPolicy(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := defaultPasswordComplexityPolicy(context.Background(), tt.args.filter)
+			got, err := defaultPasswordComplexityPolicy(authz.WithInstanceID(context.Background(), "INSTANCE"), tt.args.filter)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("defaultPasswordComplexityPolicy() error = %v, wantErr %v", err, tt.wantErr)
 				return
@@ -246,7 +247,7 @@ func Test_passwordComplexityPolicy(t *testing.T) {
 						return []eventstore.Event{
 							instance.NewPasswordComplexityPolicyAddedEvent(
 								context.Background(),
-								&instance.NewAggregate().Aggregate,
+								&instance.NewAggregate("INSTANCE").Aggregate,
 								8,
 								true,
 								true,
@@ -259,8 +260,8 @@ func Test_passwordComplexityPolicy(t *testing.T) {
 			},
 			want: &command.PasswordComplexityPolicyWriteModel{
 				WriteModel: eventstore.WriteModel{
-					AggregateID:   "IAM",
-					ResourceOwner: "IAM",
+					AggregateID:   "INSTANCE",
+					ResourceOwner: "INSTANCE",
 					Events:        []eventstore.Event{},
 				},
 				MinLength:    8,
@@ -285,7 +286,7 @@ func Test_passwordComplexityPolicy(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got, err := passwordComplexityPolicyWriteModel(context.Background(), tt.args.filter)
+			got, err := passwordComplexityPolicyWriteModel(authz.WithInstanceID(context.Background(), "INSTANCE"), tt.args.filter)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("defaultPasswordComplexityPolicy() error = %v, wantErr %v", err, tt.wantErr)
 				return