Create a policy set

A policy set says, service by service, what a Member or Billing + Member user can see and do. You build it once and give it to as many users or user groups as need it.

Before you begin

You need to be an Admin or a Project Lead: these two roles manage policy sets in IAM.

A Project Policy belongs to the project you are working in when you click Add Project Policy, so switch to that project first. If it does not exist yet, see Create a project. A User Group Policy belongs to no project.

Project Policy Set or User Group Policy Set

Policy Set has two kinds:

• A Project Policy Set is scoped to one project.
• A User Group Policy Set is scoped to an account-wide user group.

Each list shows the policy set’s name and its description.

Create a policy set

1. Open Identity & Access Management (IAM) from the account menu, then Policy Set.
2. Click Add Project Policy or Add User Group Policy, depending on the scope you want.
3. In Policy Set Name, enter a name of up to 50 characters. In Description, enter up to 100 characters. Both are required, and neither can be only spaces. The name must differ from every other policy set in the project and from E2E’s built-in policies. MyAccount refuses a name already taken with Policy Name Should be Unique.
4. For each service listed, tick any of Read, Create, Update, and Delete.
5. Click Save.

A few services keep only Read, whatever you tick: choosing Create, Update, or Delete on one of them clears that service’s row instead, leaving only Read checked.

Attach the policy

To give a policy to a user, pick it for one of their projects on Add User or Edit. To give one to a User Group, pick a User Group Policy when you create the group, or afterwards. See User groups and Choose a role for a user.

On a policy’s row, the action menu offers View, Clone, Edit, and Delete. A built-in policy offers only View and Clone. To start from one, clone it and edit the copy.

To delete a policy set, first take it off everyone it was given to. While anyone in a project still has it, MyAccount refuses Delete with This policy is part of access for multiple Project Members, so you cannot delete it.

Once you attach your policy set to a user or a user group, they see only what the policy allows. A project with a policy can now be picked for a Member on Add User; see Invite a user.