Creating Custom Policies

Scenarios

This document describes how to create a custom policy using different methods. Custom policies allow for fine-grained permission allocation, and can flexibly meet the users' requirements for differentiated permission management.

Prerequisites

The user has logged in to the CAM console and entered the Policy Management page.

Operation Steps

Creating Policies by Using Policy Generator

During policy creation by using a policy generator, services and operations are selected from the policy wizard, resources are defined, and the policy syntax is generated automatically. This method is preferred due to its simplicity and flexibility.

1. On the Policy Management page, click Create Custom Policy in the upper left corner.

2. In the pop-up window for selecting a creation method, click Create by Policy Generator to enter the page of selecting services and operations.

3. On the page of selecting services and operations, provide the following information.

   • Service (required): Select the product to be added.
   • Operation (required): Select the operations you want to authorize.
   • Resource (required): Enter the resource you want to authorize in the six-segment resource style. Cloud products with operation-level or service-level authorization granularity do not support entering specific six-segment resources, and you can simply enter "*". For the resource description method of cloud products with resource-level authorization granularity, see the Access Management Guide document for the corresponding product in CAM-supported Products (/document/product/879033/10588). For the authorization granularity supported by cloud products, see Authorization Granularity in CAM-supported Products (/document/product/879033/10588).
   • Condition (optional): Set the effective conditions for the above authorization of sub-accounts. For details, see Effective Conditions (/document/product/20472/10608).

     Note:

     Multiple statements can be added to a single policy.

4. Choose Add Statement > Next to enter the Policy Editing page.

5. On the Policy Editing page, add information such as the policy name and description, and then confirm the policy content. The console automatically generates the policy name and content.

   Note:

   • The policy name is policygen by default, with a numerical suffix generated based on the creation date. You can also customize the name as needed.
   • The policy content corresponds to the services and operations in step 3. You can modify it as needed.

6. Click Finish to complete the creation of a custom policy by using the policy generator.

Tag-based Authorization

Policies for tag-based authorization quickly grant users or user groups access to resources with a specific tag attribute.

1. On the Policy Management page, click Create Custom Policy in the upper left corner.
2. In the pop-up window for selecting the creation method, click Tag-based Authorization to enter the Tag-based Authorization page.
   • Grant access to users/user groups: Select the users/user groups (either can be selected) you want to authorize.
   • Tag key (required): Select the tag key involved in this authorization.
   • Tag value (required): Select the tag involved in this authorization.
   • Resource: Default is management permission.
3. On the Tag-based Authorization page, select the following information and click Next to enter the Review page.
4. On the Review page, confirm the policy name and policy content, and then click Finish to complete the creation of a custom policy for tag-based authorization. The default policy name and policy content are automatically generated by the console. The policy name is policygen by default, and a numerical suffix is generated based on the creation date.