Resource Restriction Policy

Text size

Important

You will need a StackGen Admin or DevOps access to run this command.

Resource Restriction Policy

The stackgen policies resource-restriction command is used to list and upload policies that limit the StackGen or custom resources that users can select from the drag-and-drop menu in their topologies.

note

stackgen upload resource-restriction-policy is deprecated. Use stackgen policies resource-restriction upload instead.

Supported Clouds

All clouds are supported for resource restriction policies.

List Policies

stackgen policies resource-restriction list [flags]

Flag	Description
--id string	Show only the policy with this ID.
--name string	Show only the policy with this exact name.
-h, --help	Help for list.

Aliases: list, ls.

Examples

List all resource restriction policies

stackgen policies resource-restriction list

The above command will display every resource restriction policy in the project.

Upload a Policy

stackgen policies resource-restriction upload [flags]

Flags

Flag	Description
-p, --restriction-policy-file-path string	Path to resource restriction policy file.
-h, --help	Help for upload.

Examples

Upload resource restriction policy from a local file

stackgen policies resource-restriction upload -p /path/to/resource_restriction_policy.json

The above command will:

• Read the restriction policy from the specified JSON file.
• Upload the policy to the StackGen platform.
• Limit which resources users can select in the drag-and-drop menu.

File Format

Click to view

The resource restriction policy file should be in JSON format and define which resources are allowed in topologies. Here's an example:

{
  "name": "Allow s3",
  "description": "This restriction will only allow s3",
  "resources": [
    "aws_s3"
  ]
}

Each policy object must include:

• name: A unique identifier for the policy.
• description: A brief explanation of the policy's purpose.
• resources: An array of resource types that will be allowed in the drag-and-drop menu.

Example: Enforce latest custom module version in your appStack

You can enforce the use of a specific version of a custom module. In our example below, we are using a custom aws_s3 resource. This is defined using the baseId and the templateId. This helps enforce consistency and ensures developers use approved and possibly secure or optimized versions of the S3 resource in their appStacks.

{
        "name": "Allow latest version of s3",
        "description": "This restriction will only allow for resources with ResourcType aws_s3, or the specified custom modules.",
        "resources": [
                "aws_s3"
        ]
}

note

• Resource restriction policies help enforce standardization and compliance.
• Resources not listed in the policy will not be available for selection.
• You can use this to limit users to only approved resource types.