Help Center/ Application Operations Management/ User Guide (2.0)/ O&M Management (Retiring)/ Permissions Management/ Custom Policies for Automation
Updated on 2023-07-12 GMT+08:00
View PDF
Share

Custom Policies for Automation

Custom policies can be created as a supplement to the system policies of Automation. For the actions supported for custom policies, see Permissions Policies and Supported Actions.

You can create custom policies in either of the following two ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Policy. The following contains examples of common Automation custom policies.

Example Custom Policies of Automation

Example: Prohibiting a user to release or remove a service card

A policy with only "Deny" permissions must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

The following method can be used if you need to assign permissions of the CMS FullAccess policy to a user but you want to prevent the user from releasing and removing cards. Create a custom policy for denying card release and removal, and attach both policies to the group to which the user belongs. Then, the user can perform all operations on Automation except card release and removal. The following is an example deny policy:

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "cms:toolmarket:update"
            ],
         }
    ]
}
Parent topic: Permissions Management