tcb role create
v3.0.0+
The tcb role command has been available since v3.0.0.
Create a custom role.
Usage
tcb role create --name <name> --identity <identity> [options]
Parameters
| Parameter | Description | Constraint |
|---|---|---|
--name <name> | Role name (required) | 2–32 characters, start with a Chinese character/letter |
--identity <identity> | Role identifier (required, unique) | Letters/numbers/_-:@. |
--description <desc> | Role description | Up to 255 characters |
--users <uids> | Initial member UIDs, comma-separated | Up to 100 |
--policies <json> | Policy JSON array (see format below) | Up to 50 policies |
-e, --env-id <envId> | Environment ID | — |
--policies Format
The policy array supports mixed use of preset policy strings and custom policy objects:
[
"FunctionsAccess",
{
"code": "custom_api",
"name": "API Path Policy",
"description": "Only allow access to the /api path",
"effect": "allow",
"expression": {
"version": "1.0",
"statement": [
{
"action": "functions:/api/*",
"resource": "*",
"effect": "allow"
}
]
}
}
]
Custom Policy Object Fields:
| Field | Description | Required |
|---|---|---|
code | Policy unique identifier | ✅ |
effect | allow or deny | ✅ |
name | Policy name | No |
description | Description | No |
expression | Policy expression (including version + statement array) | No |
statement Sub-statement Fields:
| Field | Description | Example |
|---|---|---|
action | <feature type>:<path>, * indicates all | functions:* / functions:/api/* |
resource | Resource scope, * indicates all | * |
effect | allow or deny | allow |
Feature type enumeration: storages / functions / cloudrun / model
Examples
# Minimal Creation
tcb role create --name Developer --identity developer -e my-env-id
# Create and Assign Initial Members
tcb role create --name Developer --identity developer --users "1003,1005" -e my-env-id
# Using Preset Policies
tcb role create --name Gateway Role --identity gateway_role \
--policies '["FunctionsAccess","StoragesDeny"]' \
-e my-env-id
# Combining Preset + Custom Policies
tcb role create \
--name Full-stack Developer \
--identity fullstack_dev \
--policies '[
"FunctionsAccess",
{
"code": "custom_api",
"name": "API Path Policy",
"effect": "allow",
"expression": {
"version": "1.0",
"statement": [{"action": "functions:/api/*", "resource": "*", "effect": "allow"}]
}
}
]' \
--users "1003,1005,1007" \
-e my-env-id