# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
principalPolicy:
  principal: a1967faa-bb5b-4f07-89dc-6d455c8edf8f
  version: default
  constants:
    import:
      - account_tenant_uuids
  rules:
    - resource: identity
      actions:
      - action: attach_and_detach_role
        effect: EFFECT_ALLOW
        condition:
          match:
            all:
              of:
                - expr: R.attr.tenant.tenant_type == 'account'
                - expr: R.attr.tenant.tenant_uuid == C.test_account_tenant_uuid
      - action: list_tenants
        effect: EFFECT_ALLOW
        condition:
          match:
            all:
              of:
                - expr: R.attr.tenant.tenant_type == 'account'
                - expr: R.attr.tenant.tenant_uuid == C.test_account_tenant_uuid
      - action: view
        effect: EFFECT_ALLOW
        condition:
          match:
            all:
              of:
                - expr: R.attr.tenant.tenant_type == 'account'
                - expr: R.attr.tenant.tenant_uuid == C.test_account_tenant_uuid