Data schema
Written by
Updated at August 2, 2024
Data schema in JSON format:
{
"Version" : "string",
"Id" : "string",
"Statement" : [
{
"Sid" : "string",
("Principal" | "NotPrincipal") : ("*" | "CanonicalUser" : [
"string",
...
]),
"Effect" : ("Allow" | "Deny"),
"Action" : ("*" | [
"string",
...
]),
"Resource" : ("*" | [
"string",
...
]),
"Condition" : {
"condition_type_string" : {
"condition_key_string" : [[("string" | "number" | "Boolean"),...]...]
},
...
}
},
...
]
}
A schema can include up to 10,240 characters.
Description of schema parameters:
Parameter | Description |
---|---|
Version |
(Optional) string Access policy description version. Sample value: 2012-10-17 . |
Id |
(Optional) string General information about the policy. Some Yandex Cloud services require this value to be unique. The parameter is user-defined. Examples: test-policy , Anonymous access policy , or hrtk43sau2s8gqkaje06 . |
Statement[]. |
array Bucket policy rules. If a bucket policy with no rules is applied to the bucket, access is denied to all users. To disable request verification for a bucket policy, delete it. |
Statement[].Sid |
string (Optional) Rule ID. The parameter is user-defined. Examples: test-rule , Statement Allow , or Statement Deny . |
Statement[].Principal |
string (Optional) Requested permission subject ID. The possible recipients are a user, service account, or user group. The possible values are * and <subject_ID> .You can specify a user group in the policy using the Yandex Cloud CLI, AWS CLI, Terraform, and the API. |
Statement[].NotPrincipal |
string (Optional) ID of the subject that will not receive the requested permission. The possible recipients are a user, service account, or user group. The possible value is <subject_ID> .You can specify a user group in the policy using the Yandex Cloud CLI, AWS CLI, Terraform, and the API. |
Statement[].Effect |
string Specifies whether the requested action is denied or allowed. Possible values: Allow , Deny . |
Statement[].Action |
string Determines the action to be executed when the policy is triggered. Possible values: s3:GetObject , s3:PutObject . |
Statement[].Resource |
string Specifies the resource that the action will be performed on. Possible values:
arn:aws:s3:::samplebucket and arn:aws:s3:::samplebucket/* . |
Statement[].Condition{}. |
string (Optional) Condition that will be checked. |
Statement[].Condition{}. condition_type_string{}. |
string Condition type. Possible values: StringEquals , Bool . For a full list of values, see Comparison operators. |
Statement[].Condition{}. condition_type_string{}. condition_key_string |
string Specifies the condition whose value will be checked. Possible values: aws:PrincipalType , true . |