Custom Policies

Examples

• Example 1: Allowing users to query and operate graphs

  { 
      "Version": "1.1", 
      "Statement": [ 
          { 
              "Effect": "Allow", 
              "Action": [ 
                       "ges:*:get*",
                       "ges:*:list*",
                       "ges:graph:operate"
              ] 
          } 
      ] 
  }

• Example 2: Preventing graph deletion

  A deny policy must be used in conjunction with other policies to take effect. If the policies assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

  If you need to assign the GES FullAccess policy to a user but also forbid that user from deleting graphs, you can create a custom policy that blocks graph deletion, and then assign both policies to the group the user belongs to. The user will be granted full access based on the system policy, but the custom policy will then override the permission allowing graph deletion. The following is an example of a deny policy:

  { 
        "Version": "1.1", 
        "Statement": [ 
              { 
  		  "Effect": "Deny", 
                    "Action": [ 
                          "ges:graph:delete" 
                    ] 
              } 
        ] 
  }

• Example 3: Authorizing users to perform operations on graphs whose name prefix is ges_project (ges_project names are case insensitive) and access the graph list

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "ges:graph:create",
                  "ges:graph:delete",
                  "ges:graph:access",
                  "ges:graph:getDetail"
              ],
              "Resource": [
                  "ges:*:*:graphName:ges_project*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ges:graph:list"
              ]
          }
      ]
  }

• Example 4: Authorizing users to operate only some graph resources, but allowing them to view all resources

  The policy consists of the following two parts:

  • Part 1: Authorizing users to perform operations on resources whose name prefix is ges_project. The resources include graphs and backups.
  • Part 2: Authorizing users to query the graph, backups, tasks, and metadata lists, and view job details

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "ges:backup:delete",
                  "ges:graph:access",
                  "ges:graph:operate",
                  "ges:graph:delete",
                  "ges:graph:create",
                  "ges:backup:create",
                  "ges:graph:getDetail"
              ],
              "Resource": [
                  "ges:*:*:backupName:ges_project*",
                  "ges:*:*:graphName:ges_project*" 
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "ges:graph:list",
                  "ges:backup:list",
                  "ges:jobs:list",
                  "ges:metadata:list",
                  "ges:jobs:getDetail"
              ],
              "Effect": "Allow"
          }
      ]
  }