Create an IAM policy

POST https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/policies

Creates a new IAM policy with the given name and document. Returns 409 if a policy with the same name already exists — use Update Policy to modify existing policies.

The policy document follows the AWS IAM policy syntax.

After creating a policy, attach it to an access key using the Update Access Key endpoint with the add_policies field.

Example: Read-write access to a prefix

{
  "name": "uploads-readwrite",
  "document": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
        "Resource": ["arn:aws:s3:::my-bucket/uploads/*"]
      },
      {
        "Effect": "Allow",
        "Action": ["s3:ListBucket"],
        "Resource": ["arn:aws:s3:::my-bucket"]
      }
    ]
  }
}

Request

Path Parameters

provider_id string required

Provider ID

org_id string required

Organization ID

Body required

name string required

Name of the policy. Must be unique within the organization. Only alphanumeric characters and +=,.@_- are allowed.

Possible values: <= 128 characters

document object required

AWS IAM-compatible policy document. See IAM Policies documentation for details.

Version string required

Policy language version.

Possible values: [2012-10-17]

Statement object[] required

Array

Sid string

Optional identifier for the statement

Effect string required

Whether this statement allows or denies the specified actions

Possible values: [Allow, Deny]

Action string[] required

S3 actions to allow or deny. Common actions: s3:GetObject, s3:PutObject, s3:DeleteObject, s3:ListBucket, s3:*. See supported actions.

Resource string[] required

S3 resource ARNs. Use arn:aws:s3:::bucket for bucket-level and arn:aws:s3:::bucket/prefix/* for prefix-scoped access.

Condition object

Optional conditions (IP, time-based). See condition examples.

description string

A description for the policy

Possible values: <= 1000 characters

{
  "name": "string",
  "document": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "string",
        "Effect": "Allow",
        "Action": [
          "string"
        ],
        "Resource": [
          "string"
        ],
        "Condition": {}
      }
    ]
  },
  "description": "string"
}

Responses

• 200
• default

Schema

name string required

Name of the policy

description string

document object required

AWS IAM-compatible policy document. See IAM Policies documentation for details.

Version string required

Policy language version.

Possible values: [2012-10-17]

Statement object[] required

Array

Sid string

Optional identifier for the statement

Effect string required

Whether this statement allows or denies the specified actions

Possible values: [Allow, Deny]

Action string[] required

Resource string[] required

S3 resource ARNs. Use arn:aws:s3:::bucket for bucket-level and arn:aws:s3:::bucket/prefix/* for prefix-scoped access.

Condition object

Optional conditions (IP, time-based).

attachment_count integer

Number of access keys this policy is attached to

created_at date-time

updated_at date-time

{
  "name": "string",
  "description": "string",
  "document": {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "string",
        "Effect": "Allow",
        "Action": [
          "string"
        ],
        "Resource": [
          "string"
        ],
        "Condition": {}
      }
    ]
  },
  "attachment_count": 0,
  "created_at": "2024-07-29T15:51:28.071Z",
  "updated_at": "2024-07-29T15:51:28.071Z"
}

Unexpected error

Schema

message string

{
  "message": "string"
}

Authorization: X-Tigris-Signature

name: X-Tigris-Signature  
type: apiKey  
in: header  
description: HMAC-SHA256 of the canonical request signed using the signing key.  
To create the signature, concatenate the HTTP method, URL, timestamp, and nonce with a newline character in between.  Then, calculate the HMAC-SHA256 of the concatenated string using the signing key. Example:

Create the `canonical_request` as:

POST https://mgmt.storage.dev/provider/your-provider-id/orgs/user-org-id/provision 1731703213870 f8d133cb-5a42-47b1-9ef2-874bb55bab72

Then, calculate HMAC-SHA256 of the canonical request using the signing key as:

Signature = hex(sha256sign(canonical_request, "signing_key"))

name: X-Tigris-Nonce
type: apiKey
in: header
description: Random unique string to identify the request and prevent replay attacks. Example: "f8d133cb-5a42-47b1-9ef2-874bb55bab72"

name: X-Tigris-Time
type: apiKey
in: header
description: Unix timestamp in milliseconds of the request. Example: 1731703213870

```csharp
var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/policies");
request.Headers.Add("Accept", "application/json");
request.Headers.Add("X-Tigris-Signature", "<X-Tigris-Signature>");
request.Headers.Add("X-Tigris-Nonce", "<X-Tigris-Nonce>");
request.Headers.Add("X-Tigris-Time", "<X-Tigris-Time>");
var content = new StringContent("{\n  \"name\": \"string\",\n  \"document\": {\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n      {\n        \"Sid\": \"string\",\n        \"Effect\": \"Allow\",\n        \"Action\": [\n          \"string\"\n        ],\n        \"Resource\": [\n          \"string\"\n        ],\n        \"Condition\": {}\n      }\n    ]\n  },\n  \"description\": \"string\"\n}", null, "application/json");
request.Content = content;
var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();
Console.WriteLine(await response.Content.ReadAsStringAsync());