# \[NACM\] Restrict access of list element

**URL:** https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839
**Category:** YANG
**Created:** [March 13, 2018, 4:02pm UTC](https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839 "2018-03-13T16:02:09Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sszabolcs](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sszabolcs](https://dmap-community.ductus.global/u/sszabolcs)
#### Post date: [March 13, 2018, 4:02pm UTC](https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839/1 "2018-03-13T16:02:10Z")

</div>

I would like to restrict the access of a list element if one of its non-key parameter has a specific value. Is this possible with NACM rules?

I tried with the following aaa config and it wasn’t worked for me.

Example aaa config part:

```auto
      <rule>
          <name>deny-list-elem</name>
          <path>/list/list-elem[non-key-param='restricted']</path>
          <access-operations>create read update delete</access-operations>
          <action>deny</action>
      </rule>
      <rule>
          <name>list-elem</name>
          <path>/list/list-elem/path>
          <access-operations>create read update delete</access-operations>
          <action>permit</action>
      </rule>

```

Corresponding YANG part:

```auto
      container list {
          list list-elem {
              key key-param;
              leaf key-param {
                  type string;
              }
              leaf non-key-param {
                  type enumeration {
                      enum allowed;
                      enum restricted;
                  }
              }
          }
      }

```

---

<div class="post-metadata">

### Author: ![waitai](https://yyz2.discourse-cdn.com/flex010/user_avatar/dmap-community.ductus.global/waitai/32/436_2.png) [@waitai](https://dmap-community.ductus.global/u/waitai)
#### Post date: [March 19, 2018, 12:39pm UTC](https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839/2 "2018-03-19T12:39:51Z")

</div>

In the path element of the rule list, you can only use the key parameters to specify the specific instance of a list.

---

<div class="post-metadata">

### Author: ![sszabolcs](https://avatars.discourse-cdn.com/v4/letter/s/96bed5/32.png) [@sszabolcs](https://dmap-community.ductus.global/u/sszabolcs)
#### Post date: [March 19, 2018, 12:44pm UTC](https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839/3 "2018-03-19T12:44:28Z")

</div>

Thanks for the clarification!

---

<div class="post-metadata">

### Author: ![JING1](https://avatars.discourse-cdn.com/v4/letter/j/22d042/32.png) [@JING1](https://dmap-community.ductus.global/u/JING1)
#### Post date: [February 11, 2019, 8:02am UTC](https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839/4 "2019-02-11T08:02:19Z")

</div>

Is there any other way to achieve the same ?

---

<div class="post-metadata">

### Author: ![manish.varshney](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@manish.varshney](https://dmap-community.ductus.global/u/manish.varshney)
#### Post date: [September 1, 2022, 9:12pm UTC](https://dmap-community.ductus.global/t/nacm-restrict-access-of-list-element/1839/5 "2022-09-01T21:12:51Z")

</div>

Hello, were you able to achieve this?  
I’ve a similar requirement, where I want to restrict access to only one element of the list.  
Say, in above data-model there are three list elements with key-param as abc, xyz, 123.  
I want to write rule to give access only to element xyz and deny access to abc and 123.  
Is this possible?  
Appreciate any thoughts.

Thanks,  
-Manish