Effect

The Effect element is required and specifies whether the statement results in an allow or an explicit deny. Valid values for Effect are Allow and Deny. The Effect value is case sensitive.

By default, access to resources is denied. To allow access to a resource, you must set the Effect element to Allow. To override an allow (for example, to override an allow that is otherwise in force), you set the Effect element to Deny.

Action

The Action element describes the specific action or actions that will be allowed or denied. Statements must include an Action element. Each Astran service has its own set of actions that describe tasks that you can perform with that service. See the list of actions page for more information.

You specify a value using a service namespace as an action prefix (iam, s3, ck...) followed by the name of the action to allow or deny. The name must match an action that is supported by the service. The prefix and the action name are case sensitive. For example, iam:ListAccessKeys is not the same as IAM:listaccesskeys. The following examples show Action elements for different services.

"Action": ["s3:ListAllMyBuckets", "iam:CreateUser", "ck:ListKits"],