IAMPolicy

Available

Deployed and supported. The fields and commands described here are stable within version v1alpha1.


`apiVersion`	`iam.stackngo.io/v1alpha1`
`kind`	`IAMPolicy`
Applied by	`sng tenant policy create` / `update` / `delete` (or `PUT /v1/iam/policies/{name}`), not by `sng apply`
Related commands	`sng tenant policy list` · `get` · `create` · `update` · `delete` · `attach` · `principals`

What it is for

An IAMPolicy is a policy document of your tenant: a list of Allow or Deny statements on actions (ssm:read, deploy:write, GET…) and resources (secret/prod-*, app/api…). It does nothing on its own: it applies to the subjects attached to it by its IAMPolicyBinding. You do not write it into the desired state yourself: sng tenant policy validates the document, writes it to your tenant's desired state, and it takes effect a few moments later. The format and evaluation are explained in Write a policy.

Minimal example

ops-read.yml
apiVersion: iam.stackngo.io/v1alpha1
kind: IAMPolicy
metadata:
  name: ops-read
spec:
  statement:
    - effect: Allow
      actions: ["ssm:read", "ssm:list", "ssm:describe"]
      resources: ["secret/*"]

sng tenant policy create ops-read -f ops-read.yml

policy "ops-read" created (pending: …)

The same document in JSON (sng tenant policy create ops-read -f ops-read.json):

ops-read.json
{ "Version": "1",
  "Statement": [
    { "Effect": "Allow", "Actions": ["ssm:read", "ssm:list", "ssm:describe"], "Resources": ["secret/*"] } ] }

No sng apply

sng apply rejects the IAMPolicy kind: policies always go through sng tenant policy or the API, which validate them before writing them. sng tenant policy create -f accepts the manifest above and only reads metadata.name (ignored in favor of NAME), spec.description, and spec.statement.

Complete annotated example

ci-publisher.yml
apiVersion: iam.stackngo.io/v1alpha1
kind: IAMPolicy
metadata:
  name: ci-publisher                     # DNS label, 63 characters; neither a managed name nor the bind- prefix
spec:
  description: publication du site, sans création ni suppression   # 256 characters max
  statement:                             # 1 to 50 statements
    - effect: Allow                      # Allow or Deny, case-sensitive
      actions: ["cdn:upload", "cdn:purge"]   # 1 to 64 actions: service:verb, HTTP method, or *
      resources: ["cdn/*"]               # 0 to 64 resources; absent or empty = ["*"]
    - effect: Deny                       # a Deny always wins over an Allow
      actions: ["cdn:*"]
      resources: ["cdn/prod-*"]          # * wildcard as a suffix of a type/name resource
    - effect: Allow
      actions: ["GET"]                   # HTTP method: routes of your generated APIs
      resources: ["https://orders-api.acme.dev.stackngo.app/v1/orders/*"]

sng tenant policy create ci-publisher -f ci-publisher.yml
sng tenant policy attach ci-publisher --oidc-trust gitlab-deploy

Fields

Cross-field validation rules

The schema has no CEL rule. The document is validated strictly by the API as early as sng tenant policy create / update (400 on the slightest deviation):

Version is "1" (added by the CLI when it reads a manifest); no key other than Version and Statement, no statement key other than Effect, Actions, Resources.
1 to 50 statements; 1 to 64 actions and at most 64 resources per statement; a document weighs at most 64 KiB.
Each action is a known pattern (service:verbe with a * wildcard, an HTTP method, or *); each resource is *, type/nom (wildcard as a suffix only), a /… path, or an https://… URL. Details are in Write a policy.
The name is a DNS label of at most 63 characters, is not the name of a managed policy (for example assume-role, readonly, readwrite, admin: 409), and does not start with bind-.

IAMPolicy

IAMPolicy déclare une policy d'autorisation de votre tenant : les actions qu'elle autorise ou refuse, et sur quelles ressources. Seule, elle ne donne aucun droit : un IAMPolicyBinding l'attache à des utilisateurs, rôles ou applications.

Champ	Description	Défaut	Validation
`apiVersion` string	`iam.stackngo.io/v1alpha1`
`kind` string	`IAMPolicy`
`metadata` ObjectMeta	Seul `metadata.name` est à renseigner (nom de la ressource dans votre tenant).
`spec` IAMPolicySpec
`status` IAMPolicyStatus

IAMPolicySpec

IAMPolicySpec : document de policy. Un refus explicite (Deny) l'emporte sur une autorisation (Allow) ; sans règle applicable, l'accès est refusé.

Champ	Description	Validation
`description` string	Description libre de ce que la policy autorise ou refuse.	MaxLength: 256
`statement` IAMPolicyStatement array	Règles de la policy (1 à 50). Chacune autorise (`Allow`) ou refuse (`Deny`) des actions sur des ressources.	MaxItems: 50 MinItems: 1
`deletionPolicy` DeletionPolicy	Block (défaut, valeur vide) : la suppression de l'IAMPolicy attend qu'aucun IAMPolicyBinding de votre tenant ne la référence, puis retire la policy. Delete : retrait immédiat, même si des bindings la référencent encore. Orphan : la policy reste en vigueur après la suppression de l'IAMPolicy.	Enum: [Block Delete Orphan] Optional: {}

IAMPolicyStatus

Champ	Description	Validation
`observedGeneration` integer	Dernière version du manifeste (metadata.generation) prise en compte par la plateforme.
`provider` ProviderStatus	Identité de la ressource dans le service d'authentification.
`lastSyncedAt` Time	Date de la dernière prise en compte réussie du manifeste.	Optional: {}
`conditions` Condition array	Conditions décrivant l'état actuel de la ressource (Ready…).
`tenant` string	Tenant auquel la policy s'applique.
`version` integer	Version de la policy après la dernière modification enregistrée.

IAMPolicyStatement

IAMPolicyStatement autorise ou refuse des actions sur des ressources du tenant.

Champ	Description	Validation
`effect` string	`Allow` pour autoriser, `Deny` pour refuser. Un `Deny` l'emporte sur un `Allow`.	Enum: [Allow Deny]
`actions` string array	Actions visées : service:verbe (ssm:read, kms:wrap, iam:AssumeRole…), méthode HTTP, ou * pour toutes.	MinItems: 1
`resources` string array	Ressources visées : , type/nom (joker * en suffixe), /chemin ou https://hôte/chemin. Vide : toutes les ressources ().

DeletionPolicy

Type sous-jacent : string

DeletionPolicy indique ce que devient la ressource quand vous supprimez son manifeste : Block bloque la suppression tant que la ressource est encore utilisée, Orphan la conserve, Delete la supprime.

Règles de validation :

Enum: [Block Orphan Delete]

Valeur	Description
`Block`	Bloque la suppression tant que la ressource est encore utilisée par une autre.
`Orphan`	Supprime le manifeste mais conserve la ressource créée.
`Delete`	Supprime la ressource avec le manifeste, sans vérifier son usage.

ProviderStatus

ProviderStatus identifie la ressource dans le service d'authentification.

Champ	Description	Défaut	Validation
`owner` string	Organisation propriétaire de l'objet dans l'annuaire d'identité. Renseigné par la plateforme.
`name` string	Nom de l'objet dans l'annuaire d'identité. Renseigné par la plateforme.
`resourceID` string	Identifiant de l'objet dans l'annuaire d'identité. Renseigné par la plateforme.

spec.deletionPolicy cannot be set through sng tenant policy: policies written by the API take the default value, Delete.

Status and conditions

The easiest way is to read the status through the CLI:

Status (`sng tenant policy list`)	Meaning
`pending`	written to the desired state, not applied yet
`applied`	the document in effect is the one requested; `VERSION` gives its version
`deleting`	deletion requested, still in effect for a few moments

On the object side, status.tenant is the policy's tenant and status.version its version after the last application. The Ready condition is True (reason Reconciled) when the document is applied.

Reason (`Ready=False`)	Meaning	Corrective action
`InvalidDocument`	the document was rejected when applied	fix it with `sng tenant policy update`
`UnsupportedConfiguration`	the manifest breaks a rule (name, statements, effect)	same
`ScopeUnresolved`	the policy's tenant could not be determined	automatic retry; if it persists, contact support
`ProviderUnavailable`	identity service temporarily unreachable	automatic retry
`InsufficientRBAC`	platform-side incident	contact support

A policy that stays pending for more than a few minutes indicates one of these reasons.

What happens on creation and deletion

Creation and update. sng tenant policy create|update → PUT /v1/iam/policies/<nom>: validation, 202 Accepted response with status: "pending". A few moments later, the document takes effect and version increases. Sessions already open see the change as soon as it takes effect (each request is evaluated against the policies in effect).

Deletion. sng tenant policy delete <nom> deletes the policy and its binding bind-<nom> (202). A few moments later, its subjects lose the rights it granted. Managed policies cannot be deleted (409).

Managed policies. The policies created with the tenant (default: true) cannot be modified but can be attached like yours.

Common errors

Symptom	Cause	Fix
`sng apply` rejects the `IAMPolicy` kind	policies do not go through `sng apply`	`sng tenant policy create NAME -f FILE`
`400 policies: invalid request: statement[0]: …`	malformed action or resource, unknown key, misspelled effect (`allow`)	fix the document; `Effect` is case-sensitive
`409 policies: reserved: "admin" is a default policy of the tenant core`	name of a managed policy	choose another name; attach the managed policy if it fits
`400 … prefix "bind-" is reserved`	name starting with `bind-`	rename
`403 forbidden: insufficient permissions`	no `policy:admin` on `policy/<nom>`	`admin` policy (not `readwrite`)
`pending` status that does not move to `applied`	processing in progress, or one of the failure reasons above	wait a few minutes; otherwise contact support

What it is for​

Minimal example​

Complete annotated example​

Fields​

Cross-field validation rules​

IAMPolicy​

IAMPolicySpec​

IAMPolicyStatus​

IAMPolicyStatement​

DeletionPolicy​

ProviderStatus​

Status and conditions​

What happens on creation and deletion​

Common errors​

See also​

What it is for

Minimal example

Complete annotated example

Fields

Cross-field validation rules

IAMPolicy

IAMPolicySpec

IAMPolicyStatus

IAMPolicyStatement

DeletionPolicy

ProviderStatus

Status and conditions

What happens on creation and deletion

Common errors

See also