CCM Custom Policies

Example CCM Custom Policies

• Example 1: authorizing users to create a CA

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Action": [
                                  "pca:ca:create
                          ],
                          "Effect": "Allow"
                  }
          ]
  }

• Example 2: denying certificate deletion

  A policy with only "Deny" permissions must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

  If you need to assign permissions of the PCA FullAccess policy to a user but you want to prevent the user from deleting certificates, you can create a custom policy for denying certificate deletion, and attach both policies to the group that the user belongs to. Then, the user can perform all operations on certificates except deleting certificates. The following is an example of a deny policy:

  {
          "Version": "1.1",
          "Statement": [
                  {
                          "Action": [
                                  "pca:ca:delete"
                          ],
                          "Effect": "Deny"
                  }
          ]
  }