If system policies do not meet your requirements, you can create custom policies for fine-grained, least-privilege access control. This topic provides common scenarios and policy examples for PrivateZone custom policies.
What are custom policies
In Resource Access Management (RAM), custom policies supplement system policies and can be created, updated, and deleted as needed. You are responsible for maintaining their versions.
-
After you create a custom policy, you can attach it to a RAM user, user group, or RAM role to grant the specified permissions.
-
You can delete custom policies. Before you delete a policy, make sure it is not referenced. If it is, revoke the permissions from its reference records first.
-
Custom policies support versioning. You can manage policy versions by using the version management feature of RAM.
Operations documentation
Common scenarios and examples for custom policies
Example 1: Permissions to manage DNS records
Grant a RAM user permissions to modify the status of DNS records for a specific domain name, allowing the user to pause and enable records while retaining read-only access to all other features.
{
"Version": "1",
"Statement": [
{
"Action": [
"pvtz:SetZoneRecordStatus"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"pvtz:Search*",
"pvtz:read",
"pvtz:Describe*"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "vpc:DescribeVpcs",
"Resource": "*",
"Effect": "Allow"
}
]
}Example 2: Permissions to manage the scope of a domain name
Grant a RAM user permissions to modify the scope of a specific domain name, allowing the user to change the VPCs where the domain name takes effect while retaining read-only access to all other features.
{
"Version": "1",
"Statement": [
{
"Action": [
"pvtz:BindZoneVpc"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"pvtz:Search*",
"pvtz:read",
"pvtz:Describe*"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "vpc:DescribeVpcs",
"Resource": "*",
"Effect": "Allow"
}
]
}Authorization information reference
Before you create custom policies, review the authorization information for PrivateZone. For more information, see Authorization Information.