List cloud-policies
GET /cloud-policies
Sentinel-like guardrail policy evaluated before every provision/update job in cloud-connector (W4-01 / F2.INV.04). Built-in CIS-aligned policies (is_builtin=true, organisation=null) are platform-wide defaults; custom policies are org-scoped.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”Strapi REST filter syntax
object
Responses
Section titled “ Responses ”OK
object
object
Human-readable policy name (e.g. ‘CIS-1.1: No public S3 bucket’).
Detailed explanation of the policy and its intent.
Block = job is rejected; warn = job proceeds but a warning is emitted in audit.
Cloud provider this policy applies to. ‘all’ matches any provider.
Free-text resource type filter (e.g. ‘ec2’, ‘s3’, ‘all’). ‘all’ or empty = matches any resource type.
Simple JSON DSL: { “and”: […] } or { “or”: […] } with leaf nodes { “field”: string, “op”: “eq”|“neq”|“contains”|“exists”|“not-exists”|“gt”|“lt”, “value”: any }. Field is a dot-path into the job payload (e.g. ‘config.public_access’).
When false the policy is soft-disabled (skipped by the evaluator) without deleting it.
Built-in CIS-aligned policies seeded by bootstrap. True = platform-wide, read-only default (organisation=null). False = custom per-org.
Logical data-residency region of the tenant (CELL invariant, F2.CELL.01).
Deployment cell within home_region for blast-radius isolation (CELL invariant, F2.CELL.01).
object
object
Missing or invalid authentication
Not authorized (tenant scope or capability)