mc admin policy create

Creates a new policy on the target MinIO AIStor deployment.

MinIO AIStor deployments include the following built-in policies by default:

Syntax

Consider the following JSON policy document saved at a file called /tmp/listmybuckets.json:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "s3:ListAllMyBuckets"
         ],
         "Resource": [
            "arn:aws:s3:::*"
         ]
      }
   ]
}

The following command creates a new policy called listmybuckets on the alias myaistor using the policy found at the file /tmp/listmybuckets.json.

mc admin policy create myaistor listmybuckets /tmp/listmybuckets.json

The command has the following syntax:

mc admin policy create     \
                TARGET     \
                POLICYNAME \
                POLICYPATH

Brackets [] indicate optional parameters.
Parameters sharing a line are mutually dependent.
Parameters separated using the pipe | operator are mutually exclusive.

Copy the example to a text editor and modify as-needed before running the command in the terminal/shell.

Parameters

The mc admin policy create command accepts the following arguments:

TARGET

The alias of a configured MinIO AIStor deployment on which to add the new policy.

POLICYNAME

The name of the policy to add.

Specifying the name of an existing policy overwrites that policy on the TARGET MinIO AIStor deployment.

POLICYPATH

The file path of the policy to add. The file must be a JSON-formatted file with IAM-compatible syntax. The policy document cannot exceed 20 KiB.

The 2048-byte limit documented by AWS applies to inline session policies, those passed to AssumeRole and AssumeRoleWithWebIdentity, and not to the named policies created by this command. A policy that lists more resources than 2048 bytes allows is therefore valid here.

Global Flags

This command supports any of the global flags.

Examples

Create a new policy called custom-writeonly from the JSON file at /tmp/custom-writeonly.json on the deployment at the alias myaistor.

mc admin policy create myaistor custom-writeonly /tmp/custom-writeonly.json