What Are Permission Policies?

2 min readUpdated 26 October 2026

Policies in Vultr IAM allow or deny actions using {service}.{resource}.{action} and are either managed or custom.

A permission policy is a named bundle of one or more IAM permissions that can be attached to a user, group, or role to explicitly allow or deny specific actions on Vultr resources. The individual IAM permission, which maps to a single action on a specific service, is the smallest unit of access control. A policy groups one or more of these permissions together into a reusable, assignable construct.

Every access decision in IAM, whether a user can deploy a server, view an invoice, or manage a Kubernetes cluster, traces back to a permission policy attached somewhere in the system. Policies use an allow/deny model, meaning permissions can be explicitly granted or denied. A user's effective permissions are evaluated across all policies attached to them directly or via a group, and all policies bundled within any roles assigned to them.

Each policy operates at service, resource, and action level, specifying which service is targeted (for example compute, object-storage, vke), which actions apply (for example create, update, delete, list, read) using the format {service}.{resource}.{action} with wildcard support, and can optionally be scoped to specific resources by UUID rather than applying broadly across an entire service. Policies are defined in JSON, and the Vultr Console provides a JSON preview alongside a visual builder, so you can inspect the exact definition of any policy before assigning it.

Types of Permission Policies

Managed policies are predefined and maintained by Vultr. They cover standard access patterns across all major product domains. Their underlying permission definitions are immutable. You can assign them to entities, but you cannot alter what they grant. Vultr updates them automatically when new services are launched, ensuring they stay current without any action on your part.
Custom policies allow precise, bespoke permission sets for use cases that no managed policy covers. Once created via the Vultr API or Console, custom policies can be attached to users, roles, and groups.

Note

In the current release, custom policies are designed for API-first usage. They are fully enforced for API calls, but some Vultr Console actions may not yet reflect custom policy assignments correctly. Managed policies are fully enforced in both the Console and the API.

0 Comments

Start the conversation

Be the first to comment and share your perspective with the community.

Types of Permission Policies

Managed policies are predefined and maintained by Vultr. They cover standard access patterns across all major product domains. Their underlying permission definitions are immutable. You can assign them to entities, but you cannot alter what they grant. Vultr updates them automatically when new services are launched, ensuring they stay current without any action on your part.

Custom policies allow precise, bespoke permission sets for use cases that no managed policy covers. Once created via the Vultr API or Console, custom policies can be attached to users, roles, and groups.