Policies

A policy is a document of statements that allow or deny actions on resources. You attach policies to users, bots and groups. There are two kinds:

• Managed policies are built in and the same in every organization. You can’t change or delete them. Their ID is their name, like ReadOnlyAccess.
• Custom policies are ones you write. Their ID is a UUID, and they also have a policy ID like pol_a1b2c3d4e5f6 and a resource name.

For how policies combine into a decision, see How access is decided.

Policy documents

{
  "statements": [
    {
      "sid": "ReadProjects",
      "effect": "allow",
      "actions": ["projects.list", "projects.get"],
      "resources": ["*"]
    },
    {
      "effect": "deny",
      "actions": ["projects.delete"],
      "resources": ["ezgh:*:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2"]
    }
  ]
}

Field names and effect values are lowercase. Policies have no conditions.

Actions

Actions are named <service>.<verb> or <service>.<resource>.<verb>, like projects.delete or ocr.processors.create. In an action pattern, * matches any run of characters: * is every action, projects.* every projects action, and *.list every list action. Each action or pattern must match at least one existing action; otherwise saving the policy returns 400 with invalid_request. The action reference lists every action.

Resources

A resource name identifies something a policy can target:

The part after ezgh: is the region, empty for resources that aren’t regional. The console shows each group’s, bot’s and custom policy’s Resource name on its page.

In resources:

• * alone is everything in the organization.
• Any other value starts with ezgh:, a region, and your organization’s ID (org_…), written out. A policy can only name resources in its own organization.
• * matches any run of characters. ezgh:*:org_…:prj_… matches the project, and ezgh:*:org_…:prj_…:* matches everything in it, in any region.
• A pattern with an empty region can’t end in :*, because it would miss regional resources. Use * as the region instead.

Each action is checked against one resource, shown as Checked against in the action reference. Actions that create things in the organization or act on the whole organization, such as projects.create, organizations.get or users.delete, are checked against the organization. A statement scoped to a project doesn’t allow them. This policy lets its holder see the organization and OCR models, and use OCR processors in one project only:

{
  "statements": [
    {
      "effect": "allow",
      "actions": ["organizations.get", "ocr.models.list", "ocr.models.get"],
      "resources": ["*"]
    },
    {
      "effect": "allow",
      "actions": ["projects.list", "projects.get", "ocr.processors.*", "ocr.documents.process"],
      "resources": [
        "ezgh:*:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2",
        "ezgh:*:org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2:*"
      ]
    }
  ]
}

Listing projects with this policy returns only that project.

Managed policies

Managed policies apply to everything in the organization. IAMFullAccess includes policies.attach, which lets its holder attach any policy to themselves, so treat it as administrator access.

To see a policy’s full document, open IAM > Policies and select it, or run ezgh iam policies get <policy>.

Create a custom policy

Creating a policy needs policies.create. A policy’s name is 1 to 100 characters and its description up to 1,000.

ezgh iam policies create deployers --document @policy.json --description "Deploy to production"

curl https://orgs.ezghcloud.com/v1/organizations/$ORG_ID/policies \
  -H "Authorization: Bearer $EZGH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "deployers", "document": {"statements": [{"effect": "allow", "actions": ["projects.*"], "resources": ["*"]}]}}'

To change a custom policy, select Edit on its page (policies.update), run ezgh iam policies update, or call UpdatePolicy. Changes apply to everyone it’s attached to on their next request. Deleting a custom policy (policies.delete) detaches it from every user, bot and group.

Attach a policy

Attach policies to users, bots and groups. Attaching and detaching needs policies.attach. You can’t change the root user’s policies: the root user always has AdministratorAccess.

ezgh iam policies attach ReadOnlyAccess --user ada@example.com
ezgh iam policies attach deployers --bot deployer
ezgh iam policies detach ReadOnlyAccess --group developers

curl -X POST https://orgs.ezghcloud.com/v1/organizations/$ORG_ID/users/$USER_ID/policies/ReadOnlyAccess \
  -H "Authorization: Bearer $EZGH_API_KEY"

Check permissions

Ask which actions you’re allowed, on the organization or on one resource. The answer is for whoever makes the request: your session, or the API key’s owner.

ezgh iam permissions check
ezgh iam permissions check projects.delete --resource ezgh::org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2

curl "https://orgs.ezghcloud.com/v1/organizations/$ORG_ID/permissions?actions=projects.delete&resource=ezgh::org_k3f9a0x2m7qp:prj_g7h8i9j0k1l2" \
  -H "Authorization: Bearer $EZGH_API_KEY"

Action reference

Every action a policy can name. Products add their own actions; ezgh iam actions list and ListActions return the current list. AdministratorAccess allows every action; Managed policies lists the other managed policies that allow each one.

Access level is how ReadOnlyAccess treats the action: it allows list and read actions, never write actions.

Organizations

IAM

Billing

Trails

Service Quotas

OCR