Help Center/ Cloud Certificate Manager/ Private Certificate Authority (PCA) User Guide/ PCA Permissions Management/ PCA Custom Policies
Updated on 2023-09-21 GMT+08:00
View PDF
Share

PCA Custom Policies

Custom policies can be created to supplement the system-defined policies of CCM.

You can create custom policies in either of the following two ways:

  • Visual editor: Select cloud services, actions, resources, and request conditions. This does not require knowledge of policy syntax.
  • JSON: Edit JSON policies from scratch or based on an existing policy.

For details, see Creating a Custom Policy. The following section contains examples of common PCA custom policies.

Example PCA Custom Policies

  • Example 1: authorizing users to create a CA 
    {
        "Version": "1.1",
        "Statement": [
                {
                        "Action": [
                                "pca:ca:create
                        ],
                        "Effect": "Allow"
                }
        ]
}
  • Example 2: denying certificate deletion

    A policy with only "Deny" permissions must be used in conjunction with other policies to take effect. If the permissions assigned to a user contain both "Allow" and "Deny", the "Deny" permissions take precedence over the "Allow" permissions.

    If you need to assign permissions of the PCA FullAccess policy to a user but you want to prevent the user from deleting certificates, you can create a custom policy for denying certificate deletion, and attach both policies to the group that the user belongs to. Then, the user can perform all operations on certificates except deleting certificates. The following is an example deny policy:

    {
        "Version": "1.1",
        "Statement": [
                {
                        "Action": [
                                "pca:ca:delete"
                        ],
                        "Effect": "Deny"
                }
        ]
}