JSON Writing Guide

Policies are divided into identity-based policies and resource-based policies.

• Identity-based policy: Policy granted to a principal (subject) that performs actions such as users, groups, roles, etc.
• Resource-based policy: Policy granted to a resource that determines whether to allow or deny (Effect) actions on a specific resource to a principal (subject)

Resource-based Policy

A resource-based policy is a policy that grants permission to a specified principal (requester) to perform specific operations on that resource. Therefore, resource-based policies are directly granted to resources, and only users defined in the policy can execute the policy, and the user to whom the policy is granted becomes the security principal.

{
  "Version": "2024-07-01",
  "Statement": [
        {
            "Sid": "statement1",
            "Action": ["object-store:UploadObject"],
            "Principal": {
                "scp":"srn:e::1234:::scp-iam:user/abc3d3442"
            },
            "Effect": "Allow",
            "Resource": "srn:e:::::object-store:bucket/foo"
        }
    ]
}

{
  "Version": "2024-07-01",
  "Statement": [
        {
            "Sid": "statement1",
            "Action": ["object-store:UploadObject"],
            "Principal": {
                "scp":"srn:e::1234:::scp-iam:user/abc3d3442"
            },
            "Effect": "Allow",
            "Resource": "srn:e:::::object-store:bucket/foo"
        }
    ]
}

Resource-based Policy Structure

The syntax structure and item-by-item description of resource-based policies are as follows.

{
  "Version": "2024-07-01",                                 # Version of policy syntax (fixed to 2024-07-01)
  "Statement": [
    {
      "Sid": "statement1",                                 # Policy element ID
      "Effect": "Allow",                                   # Policy effect
      "Action": ["iam:showUser"],                          # Action content defined in the policy
      "Principal": {
          "scp":"srn:e::1234:::iam:user/ROOT"              # Principal that is the target of the policy
      }
      "Resource": "srn:e::kr-west1:::scp-iam:group/foo",   # Resource where policy action is allowed
      "Condition": {                                       # Policy condition
          "StringEquals": {
            "iam:userName": [
              "scp_test_user"
              ]
          }
        }
    }
  ]
}

{
  "Version": "2024-07-01",                                 # Version of policy syntax (fixed to 2024-07-01)
  "Statement": [
    {
      "Sid": "statement1",                                 # Policy element ID
      "Effect": "Allow",                                   # Policy effect
      "Action": ["iam:showUser"],                          # Action content defined in the policy
      "Principal": {
          "scp":"srn:e::1234:::iam:user/ROOT"              # Principal that is the target of the policy
      }
      "Resource": "srn:e::kr-west1:::scp-iam:group/foo",   # Resource where policy action is allowed
      "Condition": {                                       # Policy condition
          "StringEquals": {
            "iam:userName": [
              "scp_test_user"
              ]
          }
        }
    }
  ]
}

Version

Version is used with a different meaning than policy version, and the current version is “2024-07-01”.

{
   "Version" : "2024-07-01"
}

Statement

Statement is information about the main elements of the policy and can be defined in the form of a single element or an array of individual elements.

"Statement" : [{statement}]
"Statement" : [{statement}, {statement}, {statement}]

Statement.Effect

Statement.Effect defines whether the policy operation is allowed.

"Effect" : "Allow" # Allow
"Effect" : "Deny"  # Deny

Statement.Principal

Statement.Principal specifies the principal that is allowed or denied access to the resource in a resource-based policy. The principals that can be specified in the Principal element are as follows:

• Root user
• IAM user
• IAM role
• Service account

"Principal" : { "scp": "srn:e::1234:::iam:user/root_user_id" }

"Principal" : {
    "scp": [
        "srn:e::1234:::iam:user/abc33333",
        "srn:e::1234:::iam:user/kef12344"
    ]
}

"Principal": {
    "Service": [
      "apigateway.samsungsdscloud.com"
    ]
}

Statement.Action

Statement.Action defines the action to be evaluated in the policy check.

• Write with case sensitivity.
• Write the action in the format of the action name defined in the action definition.

"Action" : ["{action_expression}"]                               # Single action
"Action" : ["{action_expression}", "{action_expression}", ... ]  # Multiple actions

Statement.Resource

Statement.Resource defines the SRN that specifies a specific resource or set of resources to which the policy applies.

• Write with case sensitivity.
• Write resource_expression in wildcard ("*") or SRN format.

"Resource" : ["{resource_expression}"]                                 # Single resource
"Resource" : ["{resource_expression}", "{resource_expression}", ... ]  # Multiple resources

"Resource" : ["srn:*::9b7653f6f47a42e38055934a0575a813:kr-west1::scp-compute:instance/d12937a6db0940499fdb0e18ad57b101"]   # offering wildcard notation (X)
"Resource" : ["srn:e::*:kr-west1::scp-compute:instance/d12937a6db0940499fdb0e18ad57b101"]                                  # account wildcard notation (X)
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:kr-west1::*:instance/d12937a6db0940499fdb0e18ad57b101"]   # service type notation (X)

#  region
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:*::scp-compute:instance/d12937a6db0940499fdb0e18ad57b101"]     # Entire (O)
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:kr-*::scp-compute:instance/d12937a6db0940499fdb0e18ad57b101"]  # Partial (O)

# resource-type
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:kr-west1::scp-compute:*/d12937a6db0940499fdb0e18ad57b101"]     # Entire (O)
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:kr-west1::scp-compute:ins*/d12937a6db0940499fdb0e18ad57b101"]  # Partial (O)

# resource-identifier
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:kr-west1::scp-compute:instance/*"]                             # Entire (O)
"Resource" : ["srn:e::9b7653f6f47a42e38055934a0575a813:kr-west1::scp-compute:instance/d12*101"]                       # Partial (O)

When it is a single resource, action_definition resources definition form for user lookup

kind: scp-iam:action-definition
service: iam
paths:
  /v1/users/{user_id}:
    get:
      resources:
      - "iam:user":
           resource_id: "path['user_id']"  # Scope of resources supported in user lookup action

kind: scp-iam:action-definition
service: iam
paths:
  /v1/users/{user_id}:
    get:
      resources:
      - "iam:user":
           resource_id: "path['user_id']"  # Scope of resources supported in user lookup action

{
  "Version": "2024-07-01",
  "Statement": [
        {
            "Sid": "statement1",
            "Action": ["iam:showUser"],
            "Effect": "Allow",
            "Resource": [
                    "*",  #  Expression for all resources,
                    "srn:e:::::scp-iam:user/94c2ae8e7d5d471683a6135446183a12", # Expression for specific user resource
                    "srn:e:::::scp-iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource -> If you write that resource in user lookup action, the written content is ignored during policy evaluation.
             ]
        }
    ]
}

{
  "Version": "2024-07-01",
  "Statement": [
        {
            "Sid": "statement1",
            "Action": ["iam:showUser"],
            "Effect": "Allow",
            "Resource": [
                    "*",  #  Expression for all resources,
                    "srn:e:::::scp-iam:user/94c2ae8e7d5d471683a6135446183a12", # Expression for specific user resource
                    "srn:e:::::scp-iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource -> If you write that resource in user lookup action, the written content is ignored during policy evaluation.
             ]
        }
    ]
}

When it is multiple resources, action_definition resources definition form for user policy lookup

When defining multiple different resources, define the resource type written in the policy.

kind: scp-iam:action-definition
service: iam
paths:
  /v1/user/{user_id}/policy/{policy_id}
    get:
      resources:
      - "iam:user":
         resource_id : "path['user_id']"
      - "iam:policy":
         resource_id : "path['policy_id']"

• Normal: Specific user specific policy example

{
  "Version": "2024-07-01",
  "Statement": [
        {
            "Sid": "statement1",
            "Action": ["iam:ShowUserPolicy"],
            "Effect": "Allow",
            "Resource": [
                    "srn:e:::::iam:user/94c2ae8e7d5d471683a6135446183a12",  # Expression for specific user resource
                    "srn:e:::::iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource
             ]
        }
    ]
}

{
  "Version": "2024-07-01",
  "Statement": [
        {
            "Sid": "statement1",
            "Action": ["iam:ShowUserPolicy"],
            "Effect": "Allow",
            "Resource": [
                    "srn:e:::::iam:user/94c2ae8e7d5d471683a6135446183a12",  # Expression for specific user resource
                    "srn:e:::::iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource
             ]
        }
    ]
}

• Normal: All users specific policy example

  • JSON

  Sample Code Download

  Copy Code

  Color mode

  {
    "Version": "2024-07-01",
    "Statement": [
          {
              "Sid": "statement1",
              "Action": ["iam:ShowUserPolicy"],
              "Effect": "Allow",
              "Resource": [
                      "srn:e:::::iam:user/*",                                 # Expression for all user resources
                      "srn:e:::::iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource
               ]
          }
      ]
  }

  {
    "Version": "2024-07-01",
    "Statement": [
          {
              "Sid": "statement1",
              "Action": ["iam:ShowUserPolicy"],
              "Effect": "Allow",
              "Resource": [
                      "srn:e:::::iam:user/*",                                 # Expression for all user resources
                      "srn:e:::::iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource
               ]
          }
      ]
  }

• Abnormal: user resource not described example

  • JSON

  Sample Code Download

  Copy Code

  Color mode

  {
    "Version": "2024-07-01",
    "Statement": [
          {
              "Sid": "statement1",
              "Action": ["iam:ShowUserPolicy"],
              "Effect": "Allow",
              "Resource": [
                      "srn:e:::::iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource
               ]
          }
      ]
  }

  {
    "Version": "2024-07-01",
    "Statement": [
          {
              "Sid": "statement1",
              "Action": ["iam:ShowUserPolicy"],
              "Effect": "Allow",
              "Resource": [
                      "srn:e:::::iam:policy/c23fb561c689455993874fa5d5ed4a2f" # Expression for specific policy resource
               ]
          }
      ]
  }

Statement.Condition

Statement.Condition defines application conditions for a specific target to which the policy applies within the policy.

• Write with case sensitivity.
• Write a condition expression to compare the attribute condition key (or global condition key), value of the resource defined in the policy with the actual request (or resource attribute) value using condition operators.

"Condition" : {
	"{qualifier:}{operator}" : {
    	"{condition-key}" : ["{condition-value}"],
	    "{condition-key2}" : ["{condition-value}"]
	}
}

"Condition": {
   "StringEquals": {
      "iam:userName": [  # When User's name is foo or bar
          "foo", "bar"
      ],
      "iam:userCompany": [  # When User's company is Samsung
          "Samsung"
      ]
    }
  }

"Condition": {
   "NotIpAddress": {
      "scp:SourceIp": [  # When request IP is neither 1.1.1.1 nor 2.2.2.2
          "1.1.1.1/24", "2.2.2.2/24"
      ]
    }
  }

Condition Operator

Condition operators provide 7 types (string, numeric, date, Bool, IP, SRN, Null) operators.

• String operators

  Condition Operator	Operator Type	Description
  StringEquals	Positive Operator	Exact match, case sensitive
  StringNotEquals	Negative Operator	Mismatch
  StringEqualsIsIgnoreCase	Positive Operator	Exact match, case insensitive
  StringNotEqualsIsIgnoreCase	Negative Operator	Mismatch, case insensitive
  StringLike	Positive Operator	Case sensitive match, wildcard with multi-character match (*) can be included in value
  StringNotLike	Negative Operator	Case sensitive mismatch, wildcard with multi-character match (*) can be included in value

  Table. String Operators

• Numeric operators

  Condition Operator	Operator Type	Description
  NumericEquals	Positive Operator	Match
  NumericNotEquals	Negative Operator	Mismatch
  NumericLessThan	Positive Operator	Less than match
  NumericLessThanEquals	Positive Operator	Less than or equal match
  NumericGreaterThan	Positive Operator	Greater than match
  NumericGreaterThanEquals	Positive Operator	Greater than or equal match

  Table. Numeric Operators

• Date operators

  Condition Operator	Operator Type	Description
  DateEquals	Positive Operator	Match specific date
  DateNotEquals	Negative Operator	Mismatch
  DateLessThan	Positive Operator	Match before specific date/time
  DateLessThanEquals	Positive Operator	Match on or before specific date/time
  DateGreaterThan	Positive Operator	Match after specific date/time
  DateGreaterThanEquals	Positive Operator	Match on or after specific date/time

  Table. Date Operators

• Bool operators

  Condition Operator	Operator Type	Description
  Bool	Positive Operator	True, False match

  Table. Bool Operators

• IP operators

  Condition Operator	Operator Type	Description
  IpAddress	Positive Operator	Specified IP address or range
  NotIpAddress	Negative Operator	All IP addresses except specified IP address or range

  Table. IP Operators

• SRN operators

  Condition Operator	Operator Type	Description
  SrnEquals, SrnLike	Positive Operator	SRN match
  SrnNotEquals, SrnNotLike	Negative Operator	SRN mismatch

  Table. SRN Operators

• Null operators

  Condition Operator	Operator Type	Description
  Null	Positive Operator	When key is missing or value is null → True When key exists and value is not null → False

  Table. Null Operators

Condition Key

Condition keys are divided into global condition keys and resource attribute keys.

Global Condition Key

A condition key predefined in Samsung Cloud Platform that defines data such as request information, resource common information (ex-tag), network information, etc.

Resource Attribute Key

An attribute key for a specific resource, used when checking condition values based on resource attribute values.

"{service}:{resource_type}{attribute_name}"

• Resource attribute name usage example

"iam:userLastname"  (O) # Attribute name defined in resource (service: iam, resource: user, attribute_name : lastname)
"iam:userLASTNAME"  (O) # Attribute name defined in resource (case insensitive)
"iam:userLast_name" (X) # If not an attribute name defined in resource
"iam:userEmail"     (X) # If abac is false
"iam:state"         (X) # If abac field is not defined

kind: scp-resourcemanager:resource-definition
service_type: scp-iam
name: scp-iam:user
resources_uri: /v1/users
resource_type: user
display_name:
  ko: '사용자'
  en: 'User'
product_id: IAM
attributes:
  state:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.state
  firstname:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.first_name
    abac: true
  lastname:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.last_name
    abac: true
  email:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.email
    abac: false

kind: scp-resourcemanager:resource-definition
service_type: scp-iam
name: scp-iam:user
resources_uri: /v1/users
resource_type: user
display_name:
  ko: '사용자'
  en: 'User'
product_id: IAM
attributes:
  state:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.state
  firstname:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.first_name
    abac: true
  lastname:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.last_name
    abac: true
  email:
    type: string
    uri: /v1/users/{resource_id}
    method: GET
    jsonpath: $.email
    abac: false

Condition Key Definition Example

• Global condition key example: A policy that allows group detail lookup only when the value of the key (Environment) of a specific policy resource tag is “Local” or “Dev”

{
  "Version": "2024-07-01",
  "Statement": [
    {
      "Sid": "statement1",
      "Action": ["iam:showPolicy"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Condition": {
          "StringEquals": {
            "scp:ResourceTag/Environment": [  # Definition form using global condition key (scp:ResourceTag)
              "Local", "Dev"
            ]
          }
      }
    }
  ]
}

{
  "Version": "2024-07-01",
  "Statement": [
    {
      "Sid": "statement1",
      "Action": ["iam:showPolicy"],
      "Effect": "Allow",
      "Resource": ["*"],
      "Condition": {
          "StringEquals": {
            "scp:ResourceTag/Environment": [  # Definition form using global condition key (scp:ResourceTag)
              "Local", "Dev"
            ]
          }
      }
    }
  ]
}

• Resource attribute key example
  • JSON

  Sample Code Download

  Copy Code

  Color mode

  {
    "Version": "2024-07-01",
    "Statement": [
      {
        "Sid": "statement1",
        "Action": ["server:showInstance"],
        "Effect": "Allow",
        "Resource": ["*"],
        "Condition" : {
             "StringEquals" : {
                 "virtual-servers:instanceFlavor" : ["m1.small"] # When the flavor attribute of the instance resource of the virtual-servers service is "m1.small"
              }
         }
      }
    ]
  }

  {
    "Version": "2024-07-01",
    "Statement": [
      {
        "Sid": "statement1",
        "Action": ["server:showInstance"],
        "Effect": "Allow",
        "Resource": ["*"],
        "Condition" : {
             "StringEquals" : {
                 "virtual-servers:instanceFlavor" : ["m1.small"] # When the flavor attribute of the instance resource of the virtual-servers service is "m1.small"
              }
         }
      }
    ]
  }

Policy Condition Value

Defines the value for the condition key.

"Condition" :  {
   "StringEquals" : {
        "scp:resourceTag/key1": ["value1", "value2", "value3"]    # When the value of the resource tag key is key1 is value1 or value2 or value3
 }

Qualifier

Defines the operation method when the request context value extracted from the Condition key has multiple values (omit when request context value is 1). Qualifiers are divided into ForAnyValue, ForAllValues, and if no qualifier is written, ForAnyValue is defined as the default value.

• ForAnyValue: True when at least one of the values extracted from the request context matches the Operand defined in the Condition
• ForAllValues: True when the values extracted from the request context are a subset of the Operand list defined in the Condition

{
  ...
  "Condition" :  {
       "ForAllValues:StringEquals" : {
            "scp:TagKeys": ["key1", "key2", "key3"]
        }
  }
}

Qualifier Operation Example

• When the request value extracted from “scp:TagKeys” is 1: Operates as OR for each Operand regardless of qualifier
• When the request value extracted from “scp:TagKeys” is 2 or more: Result difference according to qualifier

# When the extracted request context value is ["key1", "key2", "key4"]
Operand: ["key1", "key2", "key3"]
   # key1 among request context values is included in Operand, so True
   # key2 among request context values is included in Operand, so True
   # key4 among request context values is not included in Operand, so False

ForAnyValue judges as True if at least 1 of the 3 request context values matches
ForAllValues judges as final True only if all 3 request context values are True

# When the extracted request context value is ["key1", "key2", "key4"]
Operand: ["key1", "key2", "key3"]
   # key1 among request context values is included in Operand, so True
   # key2 among request context values is included in Operand, so True
   # key4 among request context values is not included in Operand, so False

ForAnyValue judges as True if at least 1 of the 3 request context values matches
ForAllValues judges as final True only if all 3 request context values are True