> ## Documentation Index
> Fetch the complete documentation index at: https://namespace.so/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# nsc egress policy create

Create an egress policy from a JSON configuration file.

`nsc egress policy create` creates a workspace-wide egress policy from a JSON
configuration file. A policy controls outbound traffic from your instances and
can filter traffic, inject Vault secrets, or proxy requests through another
domain. You can inspect the resulting policy decisions with
[`nsc egress logs`](/docs/reference/cli/egress-logs).

Point `--spec_file` at a file containing the policy definition to create it.

## Usage

```bash theme={null}
nsc egress policy create [--spec_file <path>]
```

### Example

```bash theme={null}
nsc egress policy create --spec_file egress-policy.json
```

## Policy configuration

The following policy allows the traffic required by GitHub Actions and macOS, plus requests to
`example.com`. It also injects a Vault secret into the `Authorization` header for requests to
`example.com`. In `BLOCK` mode, it denies requests to other domains.

```json theme={null}
{
  "tag": "your-network-policy",
  "description": "CI with access to example.com",
  "mode": "BLOCK",
  "deep_packet_inspection": true,
  "additional_rulesets": ["github-actions"],
  "rules": [
    {
      "op": "ALLOW",
      "matcher": {
        "match_domains": ["example.com"]
      }
    },
    {
      "op": "INJECT",
      "matcher": {
        "match_domains": ["example.com"]
      },
      "inject": {
        "header_name": "Authorization",
        "from_secret_id": "sec_example"
      }
    }
  ]
}
```

The configuration fields are:

* `tag` identifies the policy when you apply it to a workload.
* `description` explains the policy's purpose.
* `mode` controls enforcement. `BLOCK` denies requests that are not allowed, `ADVISORY` records the
  same decisions without enforcing them, `ALLOW_ALL` permits all traffic, and `DISABLED` does not
  apply the policy.
* `deep_packet_inspection` terminates TLS so the policy can modify or proxy encrypted requests.
  Clients must trust a Namespace CA certificate made available in the instance. GitHub Actions
  jobs trust it automatically whenever the policy requires it. This option is required for `INJECT`
  and `PROXY` rules.
* `additional_rulesets` adds allow rules maintained by Namespace. The available rulesets are
  `github-actions`, `devbox`, and `macos`. Namespace updates them when GitHub Actions runners,
  Devboxes, or macOS requirements change.
* `rules` contains the policy's ordered rules. Rules from `additional_rulesets` are appended after
  the rules defined here.
* `op` selects the rule operation. `ALLOW` permits matched requests, `INJECT` sets an HTTP header
  from a Namespace Vault secret, and `PROXY` routes matched requests through another domain.
* `matcher.match_domains` lists the domains matched by a rule. Prefix a domain with `*.` to include
  its subdomains.
* `inject.header_name` names the header whose value is set, and `inject.from_secret_id` identifies
  the Vault secret that provides that value.
* `proxy.via_domain` identifies the domain that should proxy matching requests.

Save this configuration as `egress-policy.json` before running the create command. See
[Egress policies](/docs/security/egress-policy) for rule behavior, rollout guidance, and examples
of each rule type.

## Options

<h3 id="--spec_file-path">
  \--spec\_file \<path>
</h3>

Path to a JSON file containing the egress policy configuration.

## Related Topics

* [Egress policies](/docs/security/egress-policy) - Configure and monitor egress traffic
* [nsc egress policy describe](/docs/reference/cli/egress-policy-describe) - Inspect a policy
* [nsc egress policy list](/docs/reference/cli/egress-policy-list) - List available policies