Abbey Docs
  • 👋Welcome
  • Getting Started
    • Quickstart
    • Step-by-Step Tutorials
      • AWS: Managing Access to Identity Center Groups
      • AWS: Managing Access to Identity Center Permission Sets
      • AWS: Managing Access to IAM Groups
      • Azure AD: Managing Access to Groups
      • Confluent: Managing Access to Kafka ACLs
      • Databricks: Managing Access to Managed Tables in Unity Catalog
      • Databricks: Managing Access to Groups
      • GitHub: Managing Access to Teams
      • Google Cloud: Managing Access to Groups
      • Google Workspace: Managing Access to Google Groups
      • Kafka: Managing Access to ACLs
      • Okta: Managing Access to Groups
      • Postgres: Managing Access to Roles
      • Snowflake: Managing Access to Tables
      • Tabular: Managing Access to Apache Iceberg Roles
      • Tailscale: Managing Access to ACLs
      • Vault: Managing Access to Groups and Policies
      • Integrating Abbey with Terraform Cloud
      • Using Abbey with Atlantis
      • Using Abbey with Spacelift
    • Starter Kits
  • How Abbey Works
    • How Abbey Works
    • Key Concepts
  • Build a Grant Kit
    • Get a Starter Kit
    • Connect a Repo
    • Create a Grant Kit
    • Link Identities
    • Write Access Policies
    • Deploy Your Grant Kit
    • Request Access
    • Approve or Deny Access Requests
  • Use Cases
    • Time-Based Access
      • Expire After a Duration
      • Expire At a Specific Time
    • Approval Workflows
      • Using a Single Approval Step
      • Using Multiple Approval Steps
      • Conditionally Skip Approval Steps
  • Admin
    • User Roles
    • Sign-in and MFA
      • Sign-in Methods
      • Multifactor Authentication (MFA)
      • Enabling Single Sign-On
    • Sources
      • PagerDuty
      • Directory Sync
    • End User Notifications
    • Manage API Tokens
  • Reference
    • Grant Kits
      • Workflows
      • Policies
      • Outputs
    • Referencing Users and Groups
    • Linking Application Identities into Abbey
      • Why do I need to link application identities?
      • How do I Link Application Identities?
      • Supported Application Identity Types and Schemas
      • Application Data Object
    • Access Policies
      • Types of Access Policies
      • Policy Bundles
      • Inline Policies
      • Helper Functions
      • Policy Examples
    • Terms of Service
    • FAQ
      • Troubleshooting
  • Resources
    • Abbey Labs
    • Terraform Registry
    • GitHub
    • System Status
    • Privacy Policy
    • Logo
Powered by GitBook
On this page
  • .manifest
  • common.rego
  • Using the Policy Bundle in a Grant Kit
  1. Reference
  2. Access Policies

Policy Bundles

PreviousTypes of Access PoliciesNextInline Policies

Last updated 1 year ago

A policy bundle is a collection of Rego code placed within a location accessible by the Abbey Github app. Rego code is read from this location and then evaluated in our policy evaluator during the access request flow. If the policy evaluation step fails, then access will not be granted to a given resource.

In this example we'll be looking at the included policy bundle in the .

.manifest

Take a look at the .manifest file.

{"roots": ["common"]}

This specifies that the root package of the bundle is the common package.

common.rego

package common

import data.abbey.functions

allow[msg] {
    functions.expire_after("5m")
    msg := "granting access for 5 minutes"
}

common.rego contains the actual policy code that is being executed. In this case, we're using an Abbey provided function called expire_after (defined ) to say that this policy will revoke access after 5 minutes. Go ahead and change this to whatever value you like. If you want an Access Request to expire after 60 minutes, you can change the value in expire_after to "60m".

Using the Policy Bundle in a Grant Kit

You can refer to the Policy Bundle in your Grant Kit like so:

resource "abbey_grant_kit" "grant_kit_example" {
  ...

+  policies = [
+    { bundle = "github://replace-me-with-organization/replace-me-with-repo/policies" } # CHANGEME
+  ]
}

Make sure bundle points to a URI which points to the top of a bundle directory.

Quickstart Policy Bundle
here