# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json --- principals: ddex_ingester_find_or_create_account: id: ff8b855a-b316-4f31-87db-415da0e02079 roles: - user attr: type: machine tenants: {} cucumber_cypress_tests_graphql_account: id: fa0e433c-8220-43c5-8faa-b8ef83b2526b roles: - user attr: type: machine tenants: {} playwright_tests_graphql_account: id: 243c1692-fcc2-47b4-a353-6f16f586984b roles: - user attr: type: machine tenants: {} lambda_sme_ext_meta_generate_ddex: id: e02be40c-dfcf-4168-ac65-dbdae5b7d577 roles: - user attr: type: machine tenants: {} resources: account_1: id: "d6455851-3f86-48d8-b102-8d996eb92645" kind: "account" attr: tenant: tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] account_2: id: "8ddfd311-0dba-4148-8d00-9ca18461e27b5" kind: "account" attr: tenant: tenant_uuid: "8ddfd311-0dba-4148-8d00-9ca18461e27b5" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] new_account_under_sme_company_brand: id: new_account_under_sme_company_brand kind: account attr: tenant: tenant_uuid: 9b36a627-4be9-4762-b790-5628676f5f90 tenant_type: company_brand tenant_hierarchy: ["parent_company_1"] parent_rep_owner_account_that_needs_external_identifier_1_or_country_id: id: parent_rep_owner_account_that_needs_external_identifier_1_or_country_id kind: account attr: tenant: tenant_uuid: parent_rep_owner_account_that_needs_external_identifier_1_or_country_id tenant_type: account tenant_hierarchy: ["parent_company_1", "9b36a627-4be9-4762-b790-5628676f5f90"] new_account_under_non_sme_company_brand: id: new_account_under_non_sme_company_brand kind: account attr: tenant: tenant_uuid: non_sme_company_brand tenant_type: company_brand tenant_hierarchy: ["parent_company_1"] name: AccountTestSuite description: Tests for verifying the Account resource policy tests: - name: a360 input: principals: - some_hacker - jess - dima - ad_analyst - integration_test_user - account_rap_admin - melissa - parent_company_contract_admin - parent_company_account_edit - telvis - abacus_readonly_user resources: - account_1 - account_2 actions: - create - view - view_account_info - view_abacus_account_info - view_account_payee_abacus_state - view_pending_payment - "update:info" - "update:internal_staff" - "update:country_id" - view_account_service_tier - "update:service_tier" - view_account_company_brand - update_account_company_brand - delete expected: - principal: jess resource: account_1 actions: view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY create: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: jess resource: account_2 actions: view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY create: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: ad_analyst resource: account_1 actions: view_account_info: EFFECT_DENY view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY create: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_DENY delete: EFFECT_DENY - principal: account_rap_admin resource: account_1 actions: view_account_info: EFFECT_DENY view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY create: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_DENY delete: EFFECT_DENY - principal: melissa resource: account_1 actions: view_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW create: EFFECT_ALLOW "update:info": EFFECT_ALLOW "update:internal_staff": EFFECT_ALLOW "update:country_id": EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_ALLOW view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_ALLOW view: EFFECT_ALLOW delete: EFFECT_ALLOW - principal: melissa resource: account_2 actions: view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY create: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: parent_company_contract_admin resource: account_1 actions: create: EFFECT_ALLOW view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW "update:info": EFFECT_ALLOW "update:internal_staff": EFFECT_ALLOW "update:country_id": EFFECT_ALLOW view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_ALLOW view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_ALLOW view: EFFECT_ALLOW delete: EFFECT_ALLOW - principal: parent_company_contract_admin resource: account_2 actions: create: EFFECT_ALLOW view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW "update:info": EFFECT_ALLOW "update:internal_staff": EFFECT_ALLOW "update:country_id": EFFECT_ALLOW view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_ALLOW view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_ALLOW view: EFFECT_ALLOW delete: EFFECT_ALLOW - principal: parent_company_account_edit resource: account_1 actions: create: EFFECT_DENY view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW "update:info": EFFECT_ALLOW "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: parent_company_account_edit resource: account_2 actions: create: EFFECT_DENY view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW "update:info": EFFECT_ALLOW "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: telvis resource: account_1 actions: create: EFFECT_DENY view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW "update:info": EFFECT_ALLOW "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: telvis resource: account_2 actions: create: EFFECT_DENY view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: abacus_readonly_user resource: account_1 actions: create: EFFECT_DENY view_account_info: EFFECT_ALLOW view_abacus_account_info: EFFECT_ALLOW view_account_payee_abacus_state: EFFECT_ALLOW view_pending_payment: EFFECT_ALLOW "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_ALLOW "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_ALLOW update_account_company_brand: EFFECT_DENY view: EFFECT_ALLOW delete: EFFECT_DENY - principal: abacus_readonly_user resource: account_2 actions: create: EFFECT_DENY view_account_info: EFFECT_DENY view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY view_pending_payment: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view: EFFECT_DENY delete: EFFECT_DENY - name: ddex_ingester_account_creation input: principals: - ddex_ingester_find_or_create_account - parent_company_contract_admin resources: - new_account_under_sme_company_brand - new_account_under_non_sme_company_brand - parent_rep_owner_account_that_needs_external_identifier_1_or_country_id actions: - create - update_external_identifier_1 - view_account_info - update_vendor_country_id - "update:country_id" expected: - principal: ddex_ingester_find_or_create_account resource: new_account_under_sme_company_brand actions: create: EFFECT_ALLOW update_external_identifier_1: EFFECT_DENY update_vendor_country_id: EFFECT_DENY "update:country_id": EFFECT_DENY view_account_info: EFFECT_DENY - principal: ddex_ingester_find_or_create_account resource: new_account_under_non_sme_company_brand actions: create: EFFECT_DENY update_external_identifier_1: EFFECT_DENY update_vendor_country_id: EFFECT_DENY "update:country_id": EFFECT_DENY view_account_info: EFFECT_DENY - principal: ddex_ingester_find_or_create_account resource: parent_rep_owner_account_that_needs_external_identifier_1_or_country_id actions: create: EFFECT_DENY update_external_identifier_1: EFFECT_ALLOW update_vendor_country_id: EFFECT_ALLOW "update:country_id": EFFECT_ALLOW view_account_info: EFFECT_DENY - principal: parent_company_contract_admin resources: - new_account_under_sme_company_brand - new_account_under_non_sme_company_brand - parent_rep_owner_account_that_needs_external_identifier_1_or_country_id actions: create: EFFECT_ALLOW update_external_identifier_1: EFFECT_DENY update_vendor_country_id: EFFECT_DENY "update:country_id": EFFECT_ALLOW view_account_info: EFFECT_ALLOW - name: various_machines input: principals: - cucumber_cypress_tests_graphql_account - playwright_tests_graphql_account - lambda_sme_ext_meta_generate_ddex resources: - account_1 actions: - create - view - view_account_info - view_abacus_account_info - view_account_payee_abacus_state - "update:info" - "update:internal_staff" - "update:country_id" - view_account_service_tier - "update:service_tier" - view_account_company_brand - update_account_company_brand - view_sony_financial_metadata - delete expected: - principal: cucumber_cypress_tests_graphql_account resource: account_1 actions: create: EFFECT_ALLOW view_account_info: EFFECT_DENY view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: playwright_tests_graphql_account resource: account_1 actions: create: EFFECT_ALLOW view_account_info: EFFECT_DENY view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view_sony_financial_metadata: EFFECT_DENY delete: EFFECT_DENY - principal: lambda_sme_ext_meta_generate_ddex resource: account_1 actions: create: EFFECT_DENY view_account_info: EFFECT_DENY view_abacus_account_info: EFFECT_DENY view_account_payee_abacus_state: EFFECT_DENY "update:info": EFFECT_DENY "update:internal_staff": EFFECT_DENY "update:country_id": EFFECT_DENY view_account_service_tier: EFFECT_DENY "update:service_tier": EFFECT_DENY view_account_company_brand: EFFECT_DENY update_account_company_brand: EFFECT_DENY view_sony_financial_metadata: EFFECT_ALLOW delete: EFFECT_DENY