Custom Policies

This page was machine-translated. The Japanese page is the official version.

Custom policies are created by users to configure operation permissions as needed.

Create a custom policy

1. On the Access Management page, open the Policies tab and click Add Policy.
2. Enter a policy name, configure its permissions, and click Save.
3. The new policy appears in the policy list.

Specification

Policy format

Custom policies are written in JSON using the following format:

{
  "version": 1,
  "statements": [
    {
      "effect": "allow" | "deny",
      "actions": ["*" | "specific action", ...],
      "resources": ["*" | "actcast:{resource_type}:{resource_id}", ...]
    },
    ...
  ]
}

version

Specifies the Actcast Policy version. Currently, only 1 is valid.

effect

Set effect to allow or deny. A deny always takes precedence over an allow. Actions not covered by any statement are denied by default.

actions

Specifies the actions to allow or deny. Use * for all actions, or specify an action from the configurable actions and resources list.

resources

Specifies the target resources. Use * for all resources, or specify a resource from the configurable actions and resources list in the format actcast:{resource_type}:{resource_id}.

For resource_id, you can use * or a specific ID. For example, all of the following are valid resources:

• *
• actcast:act:*
• actcast:act:123

Configurable actions and resources

Behavior when there are multiple statements

When a policy contains multiple statements, access is evaluated according to the following rules.

When allow and deny are both present

deny always takes precedence over allow. In the following example, delete:cast is denied for all Cast resources:

{
  "version": 1,
  "statements": [
    { "effect": "allow", "actions": ["*"], "resources": ["*"] },
    { "effect": "deny", "actions": ["delete:cast"], "resources": ["*"] }
  ]
}

When multiple statements contain the same action

If even one statement allows an action, that action is allowed for the resource. In the following example, read:act is allowed for all Act resources:

{
  "version": 1,
  "statements": [
    { "effect": "allow", "actions": ["read:act"], "resources": ["*"] },
    { "effect": "allow", "actions": ["read:act"], "resources": ["actcast:act:123"] }
  ]
}