Skip to main content

tcb policy set

Set the user Rego authentication policy. Once saved, the legacy gateway authentication will be invalidated.

Usage​

tcb policy set [regoContent]

Parameters​

ParameterDescription
<regoContent>Rego policy content (required)
-e, --env-id <envId>Environment ID
--jsonOutput JSON
Important

Once a Rego policy is set, the legacy gateway authentication will be invalidated. Please confirm the policy content is correct before executing.

Rego Policy Format​

The policy must start with package authz.user and use OPA Rego syntax:

package authz.user

default allow := false

# Example: Allow anonymous users to access cloud functions
allow if {
  input.cloudbase.resource_type == "functions"
  input.subject.auth_type == "anonymous"
}

For details on input fields, please refer to OPA Authentication Policy Introduction.

Examples​

# Pass Rego content directly
tcb policy set 'package authz.user

default allow := false

# Allow anonymous users to access cloud functions
allow if {
  input.cloudbase.resource_type == "functions"
  input.subject.auth_type == "anonymous"
}' -e my-env-id

# Output in JSON format
tcb policy set 'package authz.user

default allow := false' --json -e my-env-id