Policy elements form the foundation of permission policies in IAM. Atomile uses these elements to define the specific scope of authorization.

Understanding these core elements will help you create and manage permission policies more effectively.

Core Policy Elements

Element	Description
Effect	Defines whether the specified actions are Allowed or Denied
Action	Specifies the operations permitted on particular resources
Resource	Identifies the specific objects being authorized

Using Policy Elements Effectively

Effect

Choose one of the following valid values:

• Allow: Grants permission
• Deny: Blocks permission

Action

Actions support multiple values defined by Atomile.

Syntax: <service-name>:<action-name>

• service-name: The name of an Atomile service
• action-name: One or more operation names for that service

Example: "Action": ["wos:ListBuckets"]

Resource

Resources identify the specific objects for which you are authorizing access.

Syntax: wsc:<service-name>:<region>:<account>:<relative-id>

Where:

• wsc: The acronym for the Atomile Console
• service-name: The product name of an Atomile service, such as wos
• region: Region information. Use an asterisk (*) if the service does not support regions.
• account: Your login name
• relative-id: The identifier for the service-related resource. This varies by service and may be a file path.

Example: "Resource": ["wsc:wos:*:*:mybucket", "wsc:wos:*:*:mybucket/*"]

Policy Example

The following permission policy allows read-only operations on the WOS bucket samplebucket while prohibiting write operations:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["wos:List*", "wos:Get*"],
      "Resource": ["wsc:wos:::samplebucket", "wsc:wos:::samplebucket/*"]
    },
    {
      "Effect": "Deny",
      "Action": ["wos:Delete*", "wos:Put*"],
      "Resource": ["wsc:wos:::samplebucket", "wsc:wos:::samplebucket/*"]
    }
  ]
}