Help Center> Cloud Stream Service> User Guide> Operation Guide> Permissions Management> CS Custom Policies
View PDF

CS Custom Policies

Custom policies can be created to supplement the system-defined policies of CS. For the actions that can be added to custom policies, see Permissions Policies and Supported Actions.

You can create custom policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Policy. The following section contains examples of common CS custom policies.

Example Policies

  • Example 1: Allowing users to query and stop a job 
    { 
    "Version": "1.1", 
    "Statement": [ 
        { 
            "Effect": "Allow", 
            "Action": [ 
                     "cs:jobs:get"
                     "cs:jobs:stop"
            ] 
        } 
    ] 
}
  • Example 2: Denying exclusive cluster deletion

    A deny policy must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

    The following method can be used if you need to assign permissions of the CS FullAccess policy to a user but also forbid the user from deleting exclusive clusters. Create a custom policy for denying exclusive cluster deletion, and assign both policies to the group the user belongs to. Then the user can perform all operations on CS except deleting exclusive clusters. The following is an example deny policy:

    { 
      "Version": "1.1", 
      "Statement": [ 
            { 
		  "Effect": "Deny", 
                  "Action": [ 
                        "cs:clusters:delete" 
                  ] 
            } 
      ] 
}
Parent topic: Permissions Management