#IAM Policy Documents Reference

This reference provides detailed information about IAM policy document structure, syntax, and components in Vidos.

#Policy Document Structure

Every IAM policy document must contain the following elements:

{
    "version": "1.0",
    "permissions": [
        // One or more permission statements
    ]
}

#Version

#Permissions

Each policy document must contain at least one permission statement.

#Permission Statement Structure

Each permission statement in a policy document consists of four required components:

{
    "effect": "allow",
    "scope": "management",
    "actions": ["create", "read"],
    "resources": [
        {
            "region": "eu",
            "service": "resolver",
            "resourceType": "instance",
            "resourceId": "resolver-prod"
        }
    ]
}

#Effect

#Scope

#Actions

For management scope, actions include:

For service scope, actions include:

#Resources

Resources define the specific Vidos resources that the permission applies to. Each resource is defined as an object with these properties:

#Regions

#Services

#Resource Types

Global service resource types:

Regional service resource types:

#Resource ID

The resource ID can be a specific identifier or a wildcard:

#Complete Example

Here's a comprehensive example of an IAM policy document that demonstrates multiple permission statements with different scopes, effects, and access patterns:

{
    "version": "1.0",
    "permissions": [
        {
            "effect": "allow",
            "scope": "management",
            "actions": ["create", "read", "update"],
            "resources": [
                {
                    "region": "eu",
                    "service": "resolver",
                    "resourceType": "instance",
                    "resourceId": "*"
                }
            ]
        },
        {
            "effect": "allow",
            "scope": "service",
            "actions": ["resolve"],
            "resources": [
                {
                    "region": "eu",
                    "service": "resolver",
                    "resourceType": "instance",
                    "resourceId": "resolver-prod"
                }
            ]
        },
        {
            "effect": "deny",
            "scope": "management",
            "actions": ["delete"],
            "resources": [
                {
                    "region": "eu",
                    "service": "resolver",
                    "resourceType": "instance",
                    "resourceId": "resolver-prod"
                }
            ]
        }
    ]
}

This policy document:

1. Allows management operations (create, read, update) for any resolver instances in the EU region
2. Allows use of the resolve action, but only for the specific resolver-prod instance
3. Explicitly denies deletion of the resolver-prod instance, adding an additional safeguard

#Policy Evaluation Rules

1. An explicit deny in any policy overrides any allows
2. If there is no explicit allow, access is denied by default
3. Permissions are evaluated within their defined scope context
4. More specific resource definitions take precedence over less specific ones