Create a cloud-policy
POST /cloud-policies
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”object
object
Human-readable policy name (e.g. ‘CIS-1.1: No public S3 bucket’).
Detailed explanation of the policy and its intent.
Block = job is rejected; warn = job proceeds but a warning is emitted in audit.
Cloud provider this policy applies to. ‘all’ matches any provider.
Free-text resource type filter (e.g. ‘ec2’, ‘s3’, ‘all’). ‘all’ or empty = matches any resource type.
Simple JSON DSL: { “and”: […] } or { “or”: […] } with leaf nodes { “field”: string, “op”: “eq”|“neq”|“contains”|“exists”|“not-exists”|“gt”|“lt”, “value”: any }. Field is a dot-path into the job payload (e.g. ‘config.public_access’).
When false the policy is soft-disabled (skipped by the evaluator) without deleting it.
Built-in CIS-aligned policies seeded by bootstrap. True = platform-wide, read-only default (organisation=null). False = custom per-org.
Logical data-residency region of the tenant (CELL invariant, F2.CELL.01).
Deployment cell within home_region for blast-radius isolation (CELL invariant, F2.CELL.01).
Responses
Section titled “ Responses ”Created
object
object
Human-readable policy name (e.g. ‘CIS-1.1: No public S3 bucket’).
Detailed explanation of the policy and its intent.
Block = job is rejected; warn = job proceeds but a warning is emitted in audit.
Cloud provider this policy applies to. ‘all’ matches any provider.
Free-text resource type filter (e.g. ‘ec2’, ‘s3’, ‘all’). ‘all’ or empty = matches any resource type.
Simple JSON DSL: { “and”: […] } or { “or”: […] } with leaf nodes { “field”: string, “op”: “eq”|“neq”|“contains”|“exists”|“not-exists”|“gt”|“lt”, “value”: any }. Field is a dot-path into the job payload (e.g. ‘config.public_access’).
When false the policy is soft-disabled (skipped by the evaluator) without deleting it.
Built-in CIS-aligned policies seeded by bootstrap. True = platform-wide, read-only default (organisation=null). False = custom per-org.
Logical data-residency region of the tenant (CELL invariant, F2.CELL.01).
Deployment cell within home_region for blast-radius isolation (CELL invariant, F2.CELL.01).
Validation error
Missing or invalid authentication
Not authorized (tenant scope or capability)