IAM Policies are JSON documents that define permissions and rules for accessing resources. These policies are attached to IAM user accounts, user groups, and service accounts to control the actions they can perform on specific resources. IAM policies follow an "allow" or "deny" principle, meaning they explicitly grant or deny access to resources and actions.

Step 1: Creating a Policy

To create a policy, follow these steps:

1. Access the IAM Console: https://iam.console.greennode.ai/
2. Click on "Policy" in the left menu.
3. Click "Create a policy."
4. Provide a policy name and an optional description.
5. Click "Next step" to continue configuring permissions.
6. By default, the interface will display the "Visual editor" tab. Use the Visual editor to continue the creation process.
7. Select a specific Product within the Greennode AI Platform you want to configure.
8. Specify the Actions allowed on the product's resources.
9. Select the Resources to which the actions apply (All resources / Specific resources).
10. Provide optional conditions for application.
11. To add a new set of Actions applicable to a new set of Resources within the same Policy, click "Add Rule" (as shown below), and continue with steps 6 to 9.
12. Review the settings and click "Create policy."

Note: For policies to function correctly, you need to attach them to a specific object (IAM user account, service account, group). Refer to the instructions below for managing policy usage.

Step 2: Creating and Editing Policies with JSON

In addition to creating and editing policies with the Visual editor, you can also use the "JSON" tab to create/edit policies. Below is a sample JSON corresponding to the following selection:

• Product: Greennode AI Platform
• Effect: Allow Permission
• Action: All Greennode AI Platfomr actions
• Resource: All resources
• Request conditions: Not set

Explanation of JSON Attributes:

• Statement: The core of the policy.
  
  • Effect: Allow or Deny permissions.
  • Action: A list of actions allowed/denied on the Resource.
  • Resource: A list of resources to which the Actions apply.
  • Condition: (Optional) Request conditions.

Relationship Between Visual Editor and JSON

The Visual editor and JSON are two policy editing tools provided by IAM Greennode AI Platform.

When you create/edit a policy from the Visual editor/JSON, the data is automatically updated between the two tabs.

To streamline the process of creating/editing policies, you can switch between the Visual editor and JSON features. Note that all actions/edits from either tab are synchronized with the other tab.

Step 3: Managing Policy Usage

To attach a policy to IAM user accounts, groups, and service accounts, follow these instructions:

1. Access the policy you want to manage.
2. On the policy details page, click the "Policy usage" tab.
3. To attach the policy to the desired objects, click the "Attach" button in the upper right corner. A popup will appear, allowing you to select the objects to apply the policy to.
4. In the popup:
   
   1. Click the "User" tab and select the IAM User Accounts to which this policy will apply.
   2. Click the "Group" tab and select the User Groups to which this policy will apply.
   3. Click the "Service Account" tab and select the Service Accounts to which this policy will apply.
5. Review the selected objects and click the "Add" button to complete the process.
6. You can review the list of objects that have just been assigned by clicking on the "User," "Group," or "Service Account" tabs.

Step 4. Deleting a Policy

You can delete a policy by following these two options:

1. Delete multiple policies at once:

   • Access IAM with the Root User Account or an IAM User Account.
   • Click on "Policy" in the left menu.
   • Select the policies you want to delete (a "Delete" button will be enabled in the upper right corner when you select at least one policy).
   • Click the "Delete" button. A confirmation dialog will appear to ensure you are not deleting the wrong policies. Then, click the "Confirm" button to complete the process.

2. Delete a single policy: We recommend accessing the policy details and reviewing the "Policy usage" information before deleting to ensure you are not deleting the wrong policy.

Note:

To avoid accidentally deleting policies that are being used by IAM objects, we recommend detaching the policy from the IAM objects instead of deleting it directly. Once a policy is deleted, it cannot be recovered.