Advanced Mode

Introduction to Topic Policies

A topic policy is configured by a topic creator to allow or disallow other users or cloud services to perform specified operations to a topic. Table 1 lists the elements consisting of a topic policy.

The following is an example topic policy, which contains two statements, Statement1 and Statement2.

{
    "Version": "2016-09-07",
    "Id": "access_policy_01",
    "Statement": [
       {Statement1},
       {Statement2}
    ]
}

Statement Elements

The following example shows how to modify a topic policy. Table 2 lists the statement elements.

{
    "Version": "2016-09-07", 
    "Id": "__default_policy_ID", 
    "Statement": [
           //The first statement
        {
            "Sid": "__user_pub_0", 
            "Effect": "Allow", 
            "Principal": {
                "CSP": [
                    "urn:csp:iam::123456789:root",
                    "urn:csp:iam::987654321:root"
                ]
            }, 
            "Action": [
                "SMN:Publish", 
                "SMN:QueryTopicDetail"
            ], 
            "Resource": "urn:smn:regionId:e23bf08ebb924730b452426c60849564:ECM_BKS_Topic"
        }, 
        //The second statement
       {
            "Sid": "__service_pub_0", 
            "Effect": "Allow", 
            "Principal": {
                "Service": [
                    "obs"
                ]
            }, 
            "Action": [
                "SMN:Publish", 
                "SMN:QueryTopicDetail"
            ], 
            "Resource": "urn:smn:regionId:e23bf08ebb924730b452426c60849564:ECM_BKS_Topic"
        }
    ]
}

Condition Elements

Conditions determine whether a statement takes effect. They enable you to configure more fine-grained control over topic permissions. Table 3 lists elements in a condition.

A statement allows the requested operation only when all conditions in the statement are met. Otherwise, the operation will be denied.

As shown in Figure 1, when a condition contains multiple operators, for example, condition1 and condition2, an AND operation is executed.

When the operator condition1 contains multiple keywords, for example, conditionKey1 and conditionKey2, an AND operation is executed.

When the keyword conditionKey1 contains multiple values, for example, value11 and value12, an OR operation is executed.

Figure 1 Condition logic

"Condition": {
    "DateLessThan":{
         "csp:CurrentTime":"2016-11-07T15:35:00Z"
    },
    "StringLike": {
         "smn:Endpoint":["*@gmail.com","*@hotmail.com"]
    }
}