Help Center/ Data Warehouse Service / Management Guide/ Preparations/ Creating a DWS Custom Policy
Updated on 2025-09-25 GMT+08:00
View PDF

Creating a DWS Custom Policy

Custom policies can be created as a supplement to the system policies of DWS. For details about the custom policy actions, see Permissions Policies and Supported Actions.

You can create custom policies in either of the following ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions without the need to know policy syntax.
  • JSON: Edit JSON policies from scratch or based on an existing policy.

For details, Creating a Custom Policy. This section provides examples of DWS custom policies.

If you select Specific for Resources, you can select Specify resource path to assign the IAM user the permissions of specific resources. The resource path format is DWS:*:*:cluster: Cluster name. For cluster resources, IAM automatically generates the resource path prefix DWS:*:*:cluster:. For the path of a specific cluster, add the cluster name to the end. You can also use a wildcard character (*) to indicate any cluster. The following are examples:

  • DWS:*:*:cluster:* indicates any cluster.
  • DWS:*:*:cluster:demo* indicates that the IAM user is assigned the permissions of clusters whose names start with demo.

Example DWS Custom Policies

  • Example 1: allowing users to create/restore, restart, and delete a cluster, configure security parameters, and reset passwords 
    {
      "Version": "1.1",
      "Statement": [
            {
                  "Effect": "Allow",
                  "Action": [
                        "dws:cluster:create",
                        "dws:cluster:restart",
                        "dws:cluster:delete",
                        "dws:cluster:setSecuritySettings",
                        "dws:cluster:resetPassword",
                        "dws:*:list*",
                        "dws:*:get*",
                        "tms:predefineTags:list"
                        "ecs:*:get*",
                        "ecs:*:list*",
                        "elb:*:list*",
                        "ecs:*:create*",
                        "ecs:*:delete*",
                        "vpc:*:get*",
                        "vpc:*:list*",
                        "vpc:*:create*",
                        "vpc:*:delete*",
                        "evs:*:get*",
                        "evs:*:list*",
                        "evs:*:create*",
                        "evs:*:delete*"
                  ]
            }
      ]
}
  • Example 2: using wildcard character (*)
    The following policy has all operation permissions on DWS snapshots. 
    {
      "Version": "1.1",
      "Statement": [
            {
                  "Effect": "Allow",
                  "Action": [
                        "dws:snapshot:*",
                        "dws:cluster:list",
                        "dws:openAPISnapshot:detail",
                        "dws:cluster:getDetail",
                        "ecs:*:get*",
                        "ecs:*:list*",
                        "vpc:*:get*",
                        "vpc:*:list*"
                  ]
            }
      ]
}
  • Example 3: denying cluster deletion

    A deny policy must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

    The following method can be used if you need to assign permissions of the DWS FullAccess policy to a user but also forbid the user from deleting clusters. Create a custom policy for denying cluster deletion, and assign both policies to the group the user belongs to. Then the user can perform all operations on DWS except deleting clusters. The following is an example of a deny policy:

    { 
      "Version": "1.1", 
      "Statement": [ 
           {
                "Effect": "Allow",
                "Action": [
                     "dws:*:list*",
                     "dws:*:get*"
                 ]
            },
            { 
		  "Effect": "Deny", 
                  "Action": [ 
                        "dws:cluster:delete"
                  ] 
            } 
      ] 
}
  • Example 4: defining multiple actions in a policy

    A custom policy can contain actions of multiple services that are all of the global or project-level type. The following is an example policy containing actions of multiple services:

    {  
         "Version": "1.1",  
         "Statement": [  
                 {  
                 "Effect": "Allow",
                 "Action": [  
                        "dws:cluster:create",
                        "dws:cluster:restart",
                        "dws:cluster:setSecuritySettings",
                        "dws:*:get*",
                        "dws:*:list*",
                        "tms:predefineTags:list",
                        "elb:*:list*",
                        "ecs:*:get*",
                        "ecs:*:list*",
                        "ecs:*:create*",
                        "vpc:*:get*",
                        "vpc:*:list*",
                        "vpc:*:create*",
                        "evs:*:get*",
                        "evs:*:list*",
                        "evs:*:create*"
                  ]
                 },
                { 
		  "Effect": "Deny", 
                  "Action": [ 
                        "dws:cluster:delete"
                  ] 
                } 

         ]  
 }
Parent Topic: Preparations