Custom policies for EventBridge - EventBridge - Alibaba Cloud Documentation Center

If system policies cannot meet your business requirements, you can create custom policies to implement the principle of least privilege. You can use custom policies to achieve fine-grained control over permissions and improve resource access security. This topic describes common scenarios in which custom policies are used in EventBridge. This topic also provides sample policies.

What is a custom policy?

Resource Access Management (RAM) policies are classified into system policies and custom policies. You need to maintain custom policies.

After you create a custom policy, you need to attach it to a RAM user, a user group, or a RAM role so that the permissions specified in the policy can be granted to the principal.
You can delete a RAM policy that is not attached to a principal. If the RAM policy is attached to a principal, you must detach the RAM policy from the principal before you can delete the RAM policy.
Custom policies support version control. You can manage custom policy versions based on the version management mechanism provided by RAM.

References

Common scenarios and sample policies

You can use the following code to define a custom policy that is used to authorize RAM users to manage event buses:

{
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "eventbridge:CreateEventBus",
                "eventbridge:GetEventBus",
                "eventbridge:DeleteEventBus",
                "eventbridge:ListEventBuses"
            ],
            "Resource":"acs:eventbridge:*:*:eventbus/*"
        }
    ],
    "Version":"1"
}

You can use the following code to define a custom policy that is used to authorize RAM users to manage event streams:

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eventbridge:CreateEventStreaming",
                "eventbridge:StartEventStreaming",
                "eventbridge:GetEventStreaming",
                "eventbridge:DeleteEventStreaming",
                "eventbridge:ListEventStreamings",
                "eventbridge:UpdateEventStreaming",
                "eventbridge:PauseEventStreaming"
            ],
            "Resource": "acs:eventbridge:*:*:eventstreaming/*"
        }
    ]
}

Authorization information

Before you use a custom policy, you must understand the permission management requirements of your business and the authorization information about EventBridge. For more information, see RAM authorization.