# Create an IAM policy ``` POST https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/policies ``` Creates a new IAM policy with the given name and document. Returns 409 if a policy with the same name already exists — use [Update Policy](/content/docs/partner-integrations/api/tigris-create-policy/#tag/iam/operation/Tigris_UpdatePolicy/index.html) to modify existing policies. The policy document follows the [AWS IAM policy syntax](/content/docs/iam/policies/index.html). After creating a policy, attach it to an access key using the [Update Access Key](/content/docs/partner-integrations/api/tigris-create-policy/#tag/iam/operation/Tigris_UpdateAccessKey/index.html) endpoint with the `add_policies` field. ##### Example: Read-write access to a prefix ```json { "name": "uploads-readwrite", "document": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"], "Resource": ["arn:aws:s3:::my-bucket/uploads/*"] }, { "Effect": "Allow", "Action": ["s3:ListBucket"], "Resource": ["arn:aws:s3:::my-bucket"] } ] } } ``` ## Request ### Path Parameters **provider_id** string required Provider ID **org_id** string required Organization ID ### Body **required** **name** string required Name of the policy. Must be unique within the organization. Only alphanumeric characters and `+=,.@_-` are allowed. **Possible values:** `<= 128 characters` **document** object required AWS IAM-compatible policy document. See [IAM Policies documentation](/content/docs/iam/policies/index.html) for details. **Version** string required Policy language version. **Possible values:** [`2012-10-17`] **Statement** object[] required Array **Sid** string Optional identifier for the statement **Effect** string required Whether this statement allows or denies the specified actions **Possible values:** [`Allow`, `Deny`] **Action** string[] required S3 actions to allow or deny. Common actions: `s3:GetObject`, `s3:PutObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:*`. See [supported actions](/content/docs/iam/policies/supported-actions/index.html). **Resource** string[] required S3 resource ARNs. Use `arn:aws:s3:::bucket` for bucket-level and `arn:aws:s3:::bucket/prefix/*` for prefix-scoped access. **Condition** object Optional conditions (IP, time-based). See [condition examples](/content/docs/iam/policies/examples/ip-restrictions/index.html). **description** string A description for the policy **Possible values:** `<= 1000 characters` ```json { "name": "string", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "string", "Effect": "Allow", "Action": [ "string" ], "Resource": [ "string" ], "Condition": {} } ] }, "description": "string" } ``` ## Responses - 200 - default **Schema** **name** string required Name of the policy **description** string **document** object required AWS IAM-compatible policy document. See [IAM Policies documentation](/content/docs/iam/policies/index.html) for details. **Version** string required Policy language version. **Possible values:** [`2012-10-17`] **Statement** object[] required Array **Sid** string Optional identifier for the statement **Effect** string required Whether this statement allows or denies the specified actions **Possible values:** [`Allow`, `Deny`] **Action** string[] required **Resource** string[] required S3 resource ARNs. Use `arn:aws:s3:::bucket` for bucket-level and `arn:aws:s3:::bucket/prefix/*` for prefix-scoped access. **Condition** object Optional conditions (IP, time-based). **attachment_count** integer Number of access keys this policy is attached to **created_at** date-time **updated_at** date-time ```json { "name": "string", "description": "string", "document": { "Version": "2012-10-17", "Statement": [ { "Sid": "string", "Effect": "Allow", "Action": [ "string" ], "Resource": [ "string" ], "Condition": {} } ] }, "attachment_count": 0, "created_at": "2024-07-29T15:51:28.071Z", "updated_at": "2024-07-29T15:51:28.071Z" } ``` Unexpected error **Schema** **message** string ```json { "message": "string" } ``` #### Authorization: X-Tigris-Signature ``` name: X-Tigris-Signature type: apiKey in: header description: HMAC-SHA256 of the canonical request signed using the signing key. To create the signature, concatenate the HTTP method, URL, timestamp, and nonce with a newline character in between. Then, calculate the HMAC-SHA256 of the concatenated string using the signing key. Example: Create the `canonical_request` as: ``` POST https://mgmt.storage.dev/provider/your-provider-id/orgs/user-org-id/provision 1731703213870 f8d133cb-5a42-47b1-9ef2-874bb55bab72 ``` Then, calculate HMAC-SHA256 of the canonical request using the signing key as: ``` Signature = hex(sha256sign(canonical_request, "signing_key")) ``` ``` name: X-Tigris-Nonce type: apiKey in: header description: Random unique string to identify the request and prevent replay attacks. Example: "f8d133cb-5a42-47b1-9ef2-874bb55bab72" ``` ``` name: X-Tigris-Time type: apiKey in: header description: Unix timestamp in milliseconds of the request. Example: 1731703213870 ``` ```csharp var client = new HttpClient(); var request = new HttpRequestMessage(HttpMethod.Post, "https://mgmt.storage.dev/v1/providers/:provider_id/orgs/:org_id/policies"); request.Headers.Add("Accept", "application/json"); request.Headers.Add("X-Tigris-Signature", ""); request.Headers.Add("X-Tigris-Nonce", ""); request.Headers.Add("X-Tigris-Time", ""); var content = new StringContent("{\n \"name\": \"string\",\n \"document\": {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"string\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"string\"\n ],\n \"Resource\": [\n \"string\"\n ],\n \"Condition\": {}\n }\n ]\n },\n \"description\": \"string\"\n}", null, "application/json"); request.Content = content; var response = await client.SendAsync(request); response.EnsureSuccessStatusCode(); Console.WriteLine(await response.Content.ReadAsStringAsync()); ```