Creating Custom Policies for CBH Instances

Example Custom Policies

• Example 1: Allowing users to change CBH instance specifications and upgrade CBH instance version.

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cbh:instance:upgrade",
                  "cbh:instance:alterSpec"
              ]
          }
      ]
  }

• Example 2: Denying a user request of restarting a CBH instance

  A deny policy must be used together with other policies. If the policies assigned to a user contain both Allow and Deny actions, the Deny actions take precedence over the Allow actions.

  The following method can be used to create a custom policy to disallow users who have the CBH FullAccess policy assigned to restart a CBH instance. Assign both CBH FullAccess and the custom policies to the group to which the user belongs. Then the user can perform all operations on CBH except restarting a CBH instance. The following is an example of a deny policy:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Deny",
              "Action": [
                  "cbh:instance:reboot"
              ]
          }
      ]
  }

• Example 3: Defining permissions for multiple services in a policy

  A custom policy can contain the actions of multiple services that are of the global or project-level type. The following is an example policy containing actions of multiple services:

  {
      "Version": "1.1",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "cbh:instance:create"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "vpc:subnets:get"
              ]
          },
          {
              "Effect": "Allow",
              "Action": [
                  "ecs:cloudServerFlavors:get"
              ]
          }
      ]
  }