stratumctl custom-policies

Manage custom Cedar policies

stratumctl custom-policies [flags]

Aliases: custom-policy, cpol

Subcommands

• stratumctl custom-policies attach: Attach a policy to a user, group, or resource
• stratumctl custom-policies attachments: List a policy’s attachments
• stratumctl custom-policies create: Create a custom policy from a statements file
• stratumctl custom-policies delete: Delete a custom policy (–force cascades attachments)
• stratumctl custom-policies detach: Detach a policy from a target
• stratumctl custom-policies get: Show a custom policy (includes generated Cedar)
• stratumctl custom-policies list: List custom policies at a scope

stratumctl custom-policies attach

Attach a policy to a user, group, or resource

stratumctl custom-policies attach <policy-id> --target-kind <user|group|resource> --target-ref <id-or-arn> [flags]

Examples

stratumctl custom-policies attach pol-4k8m2x7q9a --target-kind user --target-ref u-alice
stratumctl custom-policies attach pol-4k8m2x7q9a --target-kind group --target-ref g-5k8m2x7q9a

Flags

Flag	Type	Default	Description
--target-kind	string		user | group | resource (required)
--target-ref	string		user/group id or resource ARN (required)

stratumctl custom-policies attachments

List a policy’s attachments

stratumctl custom-policies attachments <policy-id> [flags]

Examples

stratumctl custom-policies attachments pol-4k8m2x7q9a
stratumctl custom-policies attachments pol-4k8m2x7q9a --output json

stratumctl custom-policies create

Create a custom policy from a statements file

stratumctl custom-policies create --name <n> --scope-type <t> --scope-id <id> -f <statements.json> [flags]

Examples

stratumctl custom-policies create --name ci-deployer --scope-type project --scope-id p-team-a -f statements.json
stratumctl custom-policies create --name ci-deployer --scope-type organization --scope-id o-acme --description "CI deploy rights" -f statements.json

Flags

Flag	Type	Default	Description
--description	string		description
-f, --file	string		JSON statements array file (‘-’ = stdin)
--name	string		policy name (required)
--scope-id	string		org/project id (required)
--scope-type	string		organization | project (required)

stratumctl custom-policies delete

Delete a custom policy (–force cascades attachments)

stratumctl custom-policies delete <policy-id> [--force] [flags]

Examples

stratumctl custom-policies delete pol-4k8m2x7q9a
stratumctl custom-policies delete pol-4k8m2x7q9a --force

Flags

Flag	Type	Default	Description
--force	bool	false	cascade-delete attachments

stratumctl custom-policies detach

Detach a policy from a target

stratumctl custom-policies detach <policy-id> <attachment-id> [flags]

Examples

stratumctl custom-policies detach pol-4k8m2x7q9a att-6k2m8x4q7a

stratumctl custom-policies get

Show a custom policy (includes generated Cedar)

stratumctl custom-policies get <policy-id> [flags]

Examples

stratumctl custom-policies get pol-4k8m2x7q9a
stratumctl custom-policies get pol-4k8m2x7q9a --output json

stratumctl custom-policies list

List custom policies at a scope

stratumctl custom-policies list --scope-type <organization|project> --scope-id <id> [flags]

Examples

stratumctl custom-policies list --scope-type project --scope-id p-team-a
stratumctl custom-policies list --scope-type organization --scope-id o-acme --output json

Flags

Flag	Type	Default	Description
--scope-id	string		org/project id (required)
--scope-type	string		organization | project (required)