# Policies

### What Is a Policy? 

A policy defines what actions are allowed or denied on which resources in Krutrim Cloud.

Policies are written as JSON documents containing permission rules (called statements). A policy does not grant access by itself—it only takes effect when attached to a role.

Key Characteristics

* Policies cannot be attached directly to users or groups
* Policies have no effect without roles
* All permission evaluation happens at the role level
* Users get access only through roles/groups

### Policy Rule Model

Every policy follows a structured rule model.

#### Core Policy Fields

| Field        | Description                                                                                                                                                                                                         | Required |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| Policy Name  | Unique identifier for the policy                                                                                                                                                                                    | Yes      |
| Description  | Purpose of the policy                                                                                                                                                                                               | Yes      |
| Access Rules | <p>Each policy consists of one or more rules with the following fields:<br>Policy Type: Service or capability namespace<br>Operations: Usually CRUD<br>Effect: Allow / Deny<br>Resource Name:Resources affected</p> | Yes      |

#### Access Rule Fields

| Field          | Description               | Example                                                                                                                                                                                                                                                                                             |
| -------------- | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Policy Type    | Target cloud service      | All, Security Group, VPC, Virtual machine, Krutrim Certificate Manager, Krutrim Block Storage, Krutrim Object Storage, DNS, Krutrim Kubernetes System, Auto Scaling Groups, Load Balancer, Krutrim Ai Pods, Finetuning, Evaluation, IAM, Model Registry, DBaaS, MaaS, Inference, Billing, SSH Keys. |
| Resource  Name | Resources affected        | set to \* by default)                                                                                                                                                                                                                                                                               |
| Operations     | Allowed or denied actions | Create, Read, Update and Delete                                                                                                                                                                                                                                                                     |
| Effect         | Permission outcome        | Allow or Deny                                                                                                                                                                                                                                                                                       |

<br>

Allow vs. Deny Logic

* Allow → Grants permission
* Deny → Explicitly blocks permission

Evaluation Order:

1. Deny statements are evaluated first
2. If any deny matches → access is blocked
3. If no deny matches → allow statements are evaluated
4. If no allow matches → access is denied by default

&#x20;Important: Deny always overrides allow.

***

### Policy Creation Flow

1. Define policy (name, description)
2. Specify Access Rule (service, resource, operation, effect)
3. Save the policy
4. Attach policy to role(s)
5. Assign role to users or groups

&#x20;Note: A policy has no effect until attached to a role.

***

### Managing Policies

#### Editing a Policy

You can edit a policy to:

* Update name or description
* Add, Remove or Modify statements
* remove conditions

Steps:

1. IAM → Policies
2. Select policy → Edit
3. Make changes → Save

Editing a policy immediately affects:

* All roles using the policy
* All users assigned to those roles (directly or via groups)

Changes may:

* Grant new access
* Revoke existing access
* Change / Break user workflows

Best Practices:

* Communicate changes in advance
* Review attached roles before editing
* Avoid frequent edits to widely-used policies
* Prefer creating new policies instead

#### Deleting a Policy

Policies cannot be deleted while attached to roles.

Steps:

1. Detach policy from all roles
2. Return to policy
3. Click Delete

&#x20;Warning: Deletion is permanent.

***

### Policy Types by Service

Policies are organized by service and by access level.

#### Default (System-Managed) Policies

Krutrim Cloud provides predefined policies for common use cases.

| Policy Type     | Description                   |
| --------------- | ----------------------------- |
| FullAccess      | Full control over the service |
| ReadAccess      | Read Only access              |
| ReadWriteAccess | Read and modify (no delete)   |

Characteristics:

* Created and maintained by the system
* Cannot be edited or deleted
* Evaluated like regular policies

<details>

<summary><strong>List of Default Policies</strong></summary>

<table data-header-hidden><thead><tr><th width="168.73046875">Service Name</th><th>Policy Name</th><th>Description</th><th>Resources</th></tr></thead><tbody><tr><td>asg</td><td>KASGFullAccess</td><td>Krutrim ASG Full Access Policy</td><td>Auto-Scaling Groups</td></tr><tr><td>asg</td><td>KASGReadOnlyAccess</td><td>Krutrim ASG Read Only Access Policy</td><td>Auto-Scaling Groups</td></tr><tr><td>asg</td><td>KASGReadWriteAccess</td><td>Krutrim ASG Read Write Access Policy</td><td>Auto-Scaling Groups</td></tr><tr><td>billing</td><td>KBillingFullAccess</td><td>Krutrim Billing Full Access Policy</td><td>Billing</td></tr><tr><td>dbaas</td><td>KDBaaSFullAccess</td><td>Krutrim DBaaS Full Access Policy</td><td>DBaaS</td></tr><tr><td>dbaas</td><td>KDBaaSReadOnlyAccess</td><td>Krutrim DBaaS Read Only Access Policy</td><td>DBaaS</td></tr><tr><td>dbaas</td><td>KDBaaSReadWriteAccess</td><td>Krutrim DBaaS Read Write Access Policy</td><td>DBaaS</td></tr><tr><td>dns</td><td>KDNSFullAccess</td><td>Krutrim DNS Full Access Policy</td><td><p>DNS, </p><p>Zones, </p><p>Records</p></td></tr><tr><td>dns</td><td>KDNSReadOnlyAccess</td><td>Krutrim DNS Read Only Access Policy</td><td><p>DNS, </p><p>Zones, </p><p>Records</p></td></tr><tr><td>dns</td><td>KDNSReadWriteAccess</td><td>Krutrim DNS Read Write Access Policy</td><td><p>DNS, </p><p>Zones, </p><p>Records</p></td></tr><tr><td>evaluation</td><td>KEvaluationFullAccess</td><td>Krutrim Evaluation Full Access Policy</td><td>Evaluation</td></tr><tr><td>evaluation</td><td>KEvaluationReadOnlyAccess</td><td>Krutrim Evaluation Read Only Access Policy</td><td>Evaluation</td></tr><tr><td>evaluation</td><td>KEvaluationReadWriteAccess</td><td>Krutrim Evaluation Read Write Access Policy</td><td>Evaluation</td></tr><tr><td>finetuning</td><td>KFineTuningFullAccess</td><td>Krutrim Fine Tuning Full Access Policy</td><td>Fine-Tuning</td></tr><tr><td>finetuning</td><td>KFineTuningReadOnlyAccess</td><td>Krutrim Fine Tuning Read Only Access Policy</td><td>Fine-Tuning</td></tr><tr><td>finetuning</td><td>KFineTuningReadWriteAccess</td><td>Krutrim Fine Tuning Read Write Access Policy</td><td>Fine-Tuning</td></tr><tr><td>iam</td><td>KIAMFullAdminAccessAllResources</td><td>Krutrim Centralized IAM Full Access Policy across all IAM resources</td><td><p>Users, </p><p>Groups, </p><p>Roles, </p><p>Policies, </p><p>Association Between Users/Groups/Roles/Policies</p></td></tr><tr><td>iam</td><td>KIAMReadOnlyAccessAllResources</td><td>Krutrim Centralized IAM Read Only Access Policy across all IAM resources</td><td><p>Users, </p><p>Groups, </p><p>Roles, </p><p>Policies, </p><p>Association Between Users/Groups/Roles/Policies</p></td></tr><tr><td>iam</td><td>KIAMReadWriteOnlyAccessAllResources</td><td>Krutrim Centralized IAM Read Write Access Policy across all IAM resources</td><td><p>Users, </p><p>Groups, </p><p>Roles, </p><p>Policies, </p><p>Association Between Users/Groups/Roles/Policies</p></td></tr><tr><td>iam</td><td>KIAMGroupManagerAccess</td><td>Krutrim Centralized IAM Group Management Access Policy</td><td>Groups</td></tr><tr><td>iam</td><td>KIAMGroupReadOnlyAccess</td><td>Krutrim Centralized IAM Group Read Only Access Policy</td><td>Groups</td></tr><tr><td>iam</td><td>KIAMGroupReadWriteAccess</td><td>Krutrim Centralized IAM Group read Write Access Policy</td><td>Groups</td></tr><tr><td>iam</td><td>KIAMMappingManagerAccess</td><td>Krutrim Centralized IAM User/Group/Role/Policies Association Full Access Policy</td><td>Association Between Users/Groups/Roles/Policies</td></tr><tr><td>iam</td><td>KIAMMappingReadOnlyAccess</td><td>Krutrim Centralized IAM User/Group/Role/Policies Association Read Only Access Policy</td><td>Groups</td></tr><tr><td>iam</td><td>KIAMMappingReadWriteAccess</td><td>Krutrim Centralized IAM User/Group/Role/Policies Association Read Write Access Policy</td><td>Groups</td></tr><tr><td>iam</td><td>KIAMPolicyManagerAccess</td><td>Krutrim Centralized IAM Policy Management Access Policy</td><td>Policies</td></tr><tr><td>iam</td><td>KIAMPolicyReadOnlyAccess</td><td>Krutrim Centralized IAM Policy Read Only Access Policy</td><td>Policies</td></tr><tr><td>iam</td><td>KIAMPolicyReadWriteAccess</td><td>Krutrim Centralized IAM Policy Read Write Access Policy</td><td>Policies</td></tr><tr><td>iam</td><td>KIAMRoleManagerAccess</td><td>Krutrim Centralized IAM Role Management Access Policy</td><td>Roles</td></tr><tr><td>iam</td><td>KIAMRoleReadOnlyAccess</td><td>Krutrim Centralized IAM Role Read Only Access Policy</td><td>Roles</td></tr><tr><td>iam</td><td>KIAMRolereadWriteAccess</td><td>Krutrim Centralized IAM Role Read write Access Policy</td><td>Roles</td></tr><tr><td>iam</td><td>KIAMUserManagerAccess</td><td>Krutrim Centralized IAM User Management Full Access Policy</td><td>Users</td></tr><tr><td>iam</td><td>KIAMUserReadOnlyAccess</td><td>Krutrim Centralized IAM User Read Only Access Policy</td><td>Users</td></tr><tr><td>iam</td><td>KIAMUserReadWriteAccess</td><td>Krutrim Centralized IAM User Read Write Access Policy</td><td>Users</td></tr><tr><td>inference</td><td>KInferenceFullAccess</td><td>Krutrim Inference Full Access Policy</td><td>Inference</td></tr><tr><td>inference</td><td>KInferenceReadOnlyAccess</td><td>Krutrim Inference Read Only Access Policy</td><td>Inference</td></tr><tr><td>inference</td><td>KInferenceReadWriteAccess</td><td>Krutrim Inference Read Write Access Policy</td><td>Inference</td></tr><tr><td>kbs</td><td>KBlockStorageFullAccess</td><td>Krutrim Block Storage Full Access Policy</td><td>Block Storage</td></tr><tr><td>kbs</td><td>KBlockStorageReadOnlyAccess</td><td>Krutrim Block Storage Read Only Access Policy</td><td>Block Storage</td></tr><tr><td>kbs</td><td>KBlockStorageReadWriteAccess</td><td>Krutrim Block Storage Read Write Access Policy</td><td>Block Storage</td></tr><tr><td>kcm</td><td>KCertManagerFullAccess</td><td>Krutrim Certificate Manager Full Access Policy</td><td>Certificates</td></tr><tr><td>kcm</td><td>KCertManagerReadOnlyAccess</td><td>Krutrim Certificate Manager Read Only Access Policy</td><td>Certificates</td></tr><tr><td>kcm</td><td>KCertManagerReadWriteAccess</td><td>Krutrim Certificate Manager Read Write Access Policy</td><td>Certificates</td></tr><tr><td>kks</td><td>KKSFullAccess</td><td>Kubernetes Full Access Policy</td><td>Kubernetes Cluster</td></tr><tr><td>kks</td><td>KKSReadAccess</td><td>Kubernetes Read Only Access Policy</td><td>Kubernetes Cluster</td></tr><tr><td>kks</td><td>KKSWriteAccess</td><td>Kubernetes Read and Write only Access Policy</td><td>Kubernetes Cluster</td></tr><tr><td>kos</td><td>KObjectStorageAccessKeyFullAccess</td><td>Krutrim Access Key Full Access Policy</td><td><p>KOS Access Keys,</p><p>KOS Buckets,</p><p>KOS Objects,</p><p>KOS Regions</p></td></tr><tr><td>kos</td><td>KObjectStorageFullAccess</td><td>Krutrim Object Storage Full Access Policy</td><td><p>KOS Access Keys,</p><p>KOS Buckets,</p><p>KOS Objects,</p><p>KOS Regions</p></td></tr><tr><td>kos</td><td>KObjectStorageReadOnlyAccess</td><td>Krutrim Object Storage Read Only Access Policy</td><td><p>KOS Access Keys,</p><p>KOS Buckets,</p><p>KOS Objects,</p><p>KOS Regions</p></td></tr><tr><td>kos</td><td>KObjectStorageReadWriteAccess</td><td>Krutrim Object Storage Read Write Access Policy</td><td><p>KOS Access Keys,</p><p>KOS Buckets,</p><p>KOS Objects,</p><p>KOS Regions</p></td></tr><tr><td>kpod</td><td>KKPodFullAccess</td><td>Krutrim KPod Full Access Policy</td><td>Kpods (AI Pods)</td></tr><tr><td>kpod</td><td>KKPodReadOnlyAccess</td><td>Krutrim KPod Read Only Access Policy</td><td>Kpods (AI Pods)</td></tr><tr><td>kpod</td><td>KKPodReadWriteAccess</td><td>Krutrim KPod Read Write Access Policy</td><td>Kpods (AI Pods)</td></tr><tr><td>loadbalancer</td><td>KLoadBalancerFullAccess</td><td>Krutrim Load Balancer Full Access Policy</td><td><p>Load Balancers,</p><p>Target Groups,</p><p>Listeners,</p><p>Health Monitors,</p><p>Rules,</p><p>Members</p></td></tr><tr><td>loadbalancer</td><td>KLoadBalancerReadOnlyAccess</td><td>Krutrim Load Balancer Read Only Access Policy</td><td><p>Load Balancers,</p><p>Target Groups,</p><p>Listeners,</p><p>Health Monitors,</p><p>Rules,</p><p>Members</p></td></tr><tr><td>loadbalancer</td><td>KLoadBalancerReadWriteAccess</td><td>Krutrim Load Balancer Read Write Access Policy</td><td><p>Load Balancers,</p><p>Target Groups,</p><p>Listeners,</p><p>Health Monitors,</p><p>Rules,</p><p>Members</p></td></tr><tr><td>maas</td><td>KMAASApiKeyManagerAccess</td><td>Krutrim MAAS API Key Full Access Policy</td><td>MaaS API Keys</td></tr><tr><td>maas</td><td>KMAASApiKeyReadOnlyAccess</td><td>Krutrim MAAS API Key Read Only Access Policy</td><td>MaaS API Keys</td></tr><tr><td>maas</td><td>KMAASApiKeyReadWriteAccess</td><td>Krutrim MAAS API Key Read Write Access Policy</td><td>MaaS API Keys</td></tr><tr><td>maas</td><td>KMAASFullAccess</td><td>Krutrim MAAS Full Access Policy</td><td><p>MaaS</p><p>MaaS API Keys</p></td></tr><tr><td>maas</td><td>KMAASReadOnlyAccess</td><td>Krutrim MAAS Read Only Access Policy</td><td><p>MaaS</p><p>MaaS API Keys</p></td></tr><tr><td>maas</td><td>KMAASReadWriteAccess</td><td>Krutrim MAAS Read Write Access Policy</td><td><p>MaaS</p><p>MaaS API Keys</p></td></tr><tr><td>modelRegistry</td><td>KModelRegistryFullAccess</td><td>Krutrim Model Registry Full Access Policy</td><td>Model Registry</td></tr><tr><td>modelRegistry</td><td>KModelRegistryReadOnlyAccess</td><td>Krutrim Model Registry Read Only Access Policy</td><td>Model Registry</td></tr><tr><td>modelRegistry</td><td>KModelRegistryReadWriteAccess</td><td>Krutrim Model Registry Read Write Access Policy</td><td>Model Registry</td></tr><tr><td>securityGroup</td><td>KSecurityGroupFullAccess</td><td>Security Group Full Access Policy</td><td>Security Groups</td></tr><tr><td>securityGroup</td><td>KSecurityGroupReadAccess</td><td>Security Group Read Only Access Policy</td><td>Security Groups</td></tr><tr><td>securityGroup</td><td>KSecurityGroupWriteAccess</td><td>Security Group Read and Write only Access Policy</td><td>Security Groups</td></tr><tr><td>sshkeys</td><td>KSSHFullAccess</td><td>Krutrim SSH Full Access Policy</td><td>SSH Keys</td></tr><tr><td>sshkeys</td><td>KSSHReadOnlyAccess</td><td>Krutrim SSH Read Only Access Policy</td><td>SSH Keys</td></tr><tr><td>sshkeys</td><td>KSSHReadWriteAccess</td><td>Krutrim SSH Read Write Access Policy</td><td>SSH Keys</td></tr><tr><td>vm</td><td>KVMFullAccess</td><td>Krutrim VM Full Access Policy</td><td>Virtual Machines</td></tr><tr><td>vm</td><td>KVMReadOnlyAccess</td><td>Krutrim VM Read Only Access Policy</td><td>Virtual Machines</td></tr><tr><td>vm</td><td>KVMReadWriteAccess</td><td>Krutrim VM Read Write Access Policy</td><td>Virtual Machines</td></tr><tr><td>vpc</td><td>KVPCFullAccess</td><td>Krutrim VPC Full Access Policy</td><td>VPC, Subnets, Security Groups, Static IPs</td></tr><tr><td>vpc</td><td>KVPCReadOnlyAccess</td><td>Krutrim VPC Read Only Access Policy</td><td>VPC, Subnets, Security Groups, Static IPs</td></tr><tr><td>vpc</td><td>KVPCReadWriteAccess</td><td>Krutrim VPC Read Write Access Policy</td><td>VPC, Subnets, Security Groups, Static IPs</td></tr></tbody></table>

</details>

{% hint style="success" %}
**The service names in the list above are the exact ones that can be used when accessing IAM programmatically**
{% endhint %}

***

#### Custom Policies

Custom (customer-managed) policies are defined and maintained by users that grant fine-grained, reusable permissions to identities while enforcing the principle of least privilege.

Characteristics:

* Created and maintained by the Root or IAM users (if permission given)
* Can be edited or deleted

### Policy JSON Examples&#x20;

#### Example 1: Full Access Default Policy

```
{
  "name": "KBlockStorageFullAccess",
  "description": "Krutrim Block Storage Full Access Policy",
  "statements": [
    {
      "service": "kbs",
      "resource": "*",
      "operation": "*",
      "effect": "allow"
    }
  ]
}
```

{% hint style="info" %}
The policy above allows:

* All CRUD operations on all KBS (Krutrim Block Storage) resources
  {% endhint %}

***

#### Example 2: Read Only Access Default Policy

```
{
  "name": "KASGReadOnlyAccess",
  "description": "Krutrim ASG Read Only Access Policy",
  "statements": [
    {
      "service": "asg",
      "resource": "*",
      "operation": "read",
      "effect": "allow"
    }
  ]
}
```

{% hint style="info" %}
The policy above allows:

* Allows only read operations on all ASG (Auto Scaling Group) resources
* No create, update, or delete permissions
  {% endhint %}

***

#### Example 3: Custom Policy (Explicit Deny)

```
{
  "name": "VPCFullAccessAllowAndKBSDeny",
  "description": "Allow full access to all VPC resource and deny KBS resource",
  "statements": [
    {
      "service": "vpc",
      "resource": "*",
      "operation": "*",
      "effect": "allow"
    },
    {
      "service": "kbs",
      "resource": "*",
      "operation": "*",
      "effect": "deny"
    }
  ]
}
```

{% hint style="info" %}
The policy above allows:

* Create, read, update and delete operations on all VPC resources
* Explicitly denies all access to Block Storage (KBS) resources
  {% endhint %}

***

#### Example 4: Custom Policy - Allow Kubernetes (KKS) Cluster Creation

```
{
  "Name": "FullKKSCluserAccess",
  "Description": "Allow to manage KKS clusters",
  "Statements": [
    {
      "Service": "kks",
      "Resource": "*",
      "Operation": "*",
      "Effect": "allow"
    },
    {
      "Service": "vpc",
      "Resource": "*",
      "Operation": "create,read,update",
      "Effect": "allow"
    }
  ]
}

```

{% hint style="info" %}
The policy above allows:

* Create, read, update and delete operations on all KKS resources
* Allows create, read, and update operations on all VPC resources<br>
  {% endhint %}

{% hint style="warning" %}
**To allow IAM users to create any resource, the root user needs to ensure that the IAM user is given all permissions to access / view the other services which are required to create the main resource, for example:**&#x20;

To allow an IAM user to create a Kubernetes (KKS) cluster, the necessary KKS permissions must be supplemented with permissions for other services. Specifically, during the KKS cluster creation process, the user needs the ability to view and select supporting resources, such as those related to VPC.
{% endhint %}

### Next Steps

* Attach policies to roles
* Assign roles to users or groups
* Use groups to scale access
* Review custom operations for fine-grained control


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.cloud.olakrutrim.com/basics/identity-access-management/policies.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.