Example Policies

name: administrator
policy:
  - action: '*'
    resource: '*'
    effect: allow

name: blue-things
policy:
  - action:
      - iam:List*
      - iam:Get*
    resource: iam:*
    effect: allow
  - action:
      - environments:Get*
      - environments:List*
      - environments:AccessEnvironment
    resource: environments:*
    effect: allow
  - action:
      - kafka:*
      - schemas:*
      - kafka-connect:*
      - kubernetes:*
      - applications:*
    resource:
      - kafka:topic/*/*/blue-*
      - kafka:consumer-group/*/*/blue-*
      - kafka:acl/*/*/*/user/blue-*
      - schemas:schema/*/*/blue-*
      - kafka-connect:cluster/*/*
      - kafka-connect:connector/*/*/blue-*
      - sql-streaming:processor/*/*/*/blue-*
      - kubernetes:cluster/*/*
      - kubernetes:namespace/*/*/*
      - applications:external-application/*/blue-*
    effect: allow
  - action:
      - alerts:*
      - data-policies:*
    resource:
      - alerts:alert/*/*/blue-*
      - alerts:alert-event/*/*/*
      - data-policies:policy/*/blue-*
    effect: allow

name: public-data-explorer
policy:
  - action:
      - environments:ListEnvironments
      - environments:GetEnvironmentDetails
      - environments:AccessEnvironment
    resource: environments:environment/global*
    effect: allow
  - action:
      - kafka:ListTopics
      - kafka:ListTopicDependants
      - kafka:GetTopicDetails
      - kafka:ReadTopicData
    resource: kafka:topic/*/kafka/la-*
    effect: allow
  - action:
      - schemas:ListSchemas
      - schemas:ListSchemaDependants
      - schemas:GetSchemaDetails
    resource: schemas:schema/*/*/la-*
    effect: allow

name: global-connector-operator
policy:
  - action:
      - iam:List*
      - iam:Get*
    resource: iam:*
    effect: allow
  - action:
      - environments:Get*
      - environments:List*
      - environments:AccessEnvironment
    resource: environments:*
    effect: allow
  - action:
      - kafka-connect:List*
      - kafka-connect:GetClusterDetails
      - kafka-connect:GetConnectorDetails
      - kafka-connect:StartConnector
      - kafka-connect:StopConnector
    resource:
      - kafka-connect:cluster/*/*
      - kafka-connect:connector/*/*/*
    effect: allow

name: no-access-prod
policy:
  - action: environments:AccessEnvironment
    resource: environments:environment/prod-*
    effect: deny

name: us-dev-access
policy:
  - action:
      - iam:List*
      - iam:Get*
    resource: iam:*
    effect: allow
  - action:
      - environments:Get*
      - environments:List*
    resource: environments:*
    effect: allow
  - action: environments:AccessEnvironment
    resource: environments:environment/us-dev
    effect: allow
  - action:
      - kafka:*
      - schemas:*
      - kafka-connect:*
      - kubernetes:*
      - applications:*
    resource:
      - kafka:topic/us-dev/*
      - kafka:consumer-group/us-dev/*
      - kafka:acl/us-dev/*
      - kafka:quota/us-dev/*
      - schemas:schema/us-dev/*
      - kafka-connect:cluster/us-dev/*
      - kafka-connect:connector/us-dev/*
      - sql-streaming:processor/us-dev/*
      - kubernetes:cluster/us-dev/*
      - kubernetes:namespace/us-dev/*/*
      - applications:external-application/us-dev/*
    effect: allow
  - action:
      - alerts:*
      - data-policies:*
    resource:
      - alerts:alert/us-dev/*
      - alerts:alert-event/us-dev/*
      - data-policies:policy/us-dev/*
    effect: allow