VPN Custom Policies

Example VPN custom policy

• Example 1: Allowing users to delete VPN gateways

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "vpn:vpnGateways:delete"
              ]
          }
      ]
  }

• Example 2: Denying users to delete a VPN connection

  A policy with only Deny permissions must be used in conjunction with other policies to take effect. If the policies assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

  The following method can be used if you need to assign permissions of the VPN FullAccess policy to a user but also forbid the user from deleting VPN connections. Create a custom policy for denying VPN connection deletion, and assign both policies to the group the user belongs to. Then the user can perform all operations on VPN except deleting VPN connections. The following is an example of a deny policy:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "vpn:vpnGateways:delete"
              ]
          }
      ]
  }

• Example 3: defining multiple actions in a policy

  A custom policy can contain actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "vpn:vpnGateways:create",
                  "vpn:vpnConnections:create",
                  "vpn:customerGateways:create"
              ]
          },
          {
              "Effect": "Deny",
              "Action": [
                  "vpn:vpnGateways:delete",
                  "vpn:vpnConnections:delete",
                  "vpn:customerGateways:create"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:vpcs:list",
                  "vpc:subnets:get"
              ]
          }
      ]
  }