Hiding items in Tools menu in AEMaaCS

[Kate_Sumbler]

Working in AEMaaCS and have a need to hide items from below the Tools menu. Essentially we only want General and Assets to be visible to our users.  What are the paths we need to set to deny jcr:read for these items?

I have found an answer for hiding "Sites" on the on-prem version of AEM 6.5 but am not sure if the paths are the same in the CS version. This is what was listed for Sites:

To hide Sites set deny jcr:read on these two paths:

• /libs/wcm/core/content/sites
• /libs/cq/core/content/nav/sites

Does anyone know if that is still correct in AEMaaCS? Our dev team has said they can make these permissions changes via a code deploy since the Administrator account cannot set ACEs for the /libs path, but I need to provide them with all of the paths for the other menu items.

Thanks!

[Jagadeesh_Prakash]

Hi @Kate_Sumbler 

We have overlayed the /libs/cq/core/content/nav and added below restriction in to the elements

Location : \ui.apps\src\main\content\jcr_root\apps\cq\core\content\nav

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:granite="http://www.adobe.com/jcr/granite/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
    jcr:primaryType="nt:unstructured">
    <projects jcr:primaryType="nt:unstructured">
        <granite:rendercondition
            jcr:primaryType="nt:unstructured"
            sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
            groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
    </projects>
    <sites jcr:primaryType="nt:unstructured">
        <granite:rendercondition
            jcr:primaryType="nt:unstructured"
            sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
            groups="[dam-admin,Sites-Author,Sites-Admin,AEM Stage Author,Stage US Author,Stage US Reader,Stage US Admin,AEM Stage Reader,AEM Prod Author,Prod US Author,Prod US Admin,Prod US Reader,AEM QA Author,AEM QA Reader,AEM Dev Author,AEM Dev Reader,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
    </sites>
    <experiencefragments jcr:primaryType="nt:unstructured">
        <granite:rendercondition
            jcr:primaryType="nt:unstructured"
            sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
            groups="[dam-admin,Sites-Author,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin,AEM Stage Author,Stage US Admin,Stage US Author,AEM QA Author,AEM Dev Author,Stage US Admin,AEM Prod Author,Prod US Admin,Prod US Author]"/>
    </experiencefragments>
    <assets jcr:primaryType="nt:unstructured">
        <collections jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </collections>
        <links jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/renderconditions/and">
                <isAdmin
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
                <privilege
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="granite/ui/components/coral/foundation/renderconditions/privilege"
                    path="/var/dam/share"
                    privileges="[jcr:read]"/>
            </granite:rendercondition>
        </links>
        <templates jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/renderconditions/and">
                <isAdmin
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin,Stage US Admin]"/>
                <featureToggle
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="granite/ui/components/renderconditions/featuretoggle"
                    toggleName="FT_CQ-4281801"/>
            </granite:rendercondition>
        </templates>
        <asyncjobs jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </asyncjobs>
        <trainingmodels jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/renderconditions/and">
                <isAdmin
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
                <isGuidedTraining
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="dam/gui/coral/components/commons/renderconditions/isguidedtraining"/>
            </granite:rendercondition>
        </trainingmodels>
        <stocksearch jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/coral/foundation/renderconditions/and">
                <stockfeature
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="granite/ui/components/foundation/renderconditions/feature"
                    feature="com.adobe.dam.asset.stock.feature.flag"/>
                <stockaccessible
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="dam/gui/coral/components/commons/renderconditions/stockaccessible"/>
                <isAdmin
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </granite:rendercondition>
        </stocksearch>
    </assets>
    <contentfragments jcr:primaryType="nt:unstructured">
        <granite:rendercondition
            jcr:primaryType="nt:unstructured"
            sling:resourceType="granite/ui/components/coral/foundation/renderconditions/and">
            <isAdmin
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            <featureToggle
                jcr:primaryType="nt:unstructured"
                sling:resourceType="granite/ui/components/renderconditions/featuretoggle"
                toggleName="ft-cq-4319342"/>
        </granite:rendercondition>
    </contentfragments>
    <tools jcr:primaryType="nt:unstructured">
        <general jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            <crxdelite jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </crxdelite>
            <customsearchfacets jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </customsearchfacets>
            <tagging jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Author,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin,AEM Stage Reader,AEM Stage Author,Stage US Admin,Stage US Approver,Stage US Author,Stage US Reader,AEM QA Author,AEM QA Reader,AEM Dev Author,AEM Dev Reader,Stage US Approver,Stage All Author,Stage US Author,Stage US Admin,Stage All Reader,AEM Prod Author,AEM Prod Reader,Prod US Admin,Prod US Approver,Prod US Author,Prod US Reader]"/>
            </tagging>
            <templates jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin,Stage US Admin]"/>
            </templates>
            <components jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </components>
            <configuration-browser jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </configuration-browser>
            <translationRules jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="granite/ui/components/coral/foundation/renderconditions/and">
                    <isAdmin
                        jcr:primaryType="nt:unstructured"
                        sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                        groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
                    <isProjectAdmin
                        jcr:primaryType="nt:unstructured"
                        sling:resourceType="cq/translation/cloudservices/rendercondition/isProjectAdmin"/>
                </granite:rendercondition>
            </translationRules>
            <asyncjobs jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </asyncjobs>
            <asyncjobsconfig jcr:primaryType="nt:unstructured">
                <granite:rendercondition
                    jcr:primaryType="nt:unstructured"
                    sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                    groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
            </asyncjobsconfig>
        </general>
        <workflow jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </workflow>
        <sites jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </sites>
        <assets jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </assets>
        <resources jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </resources>
        <deployment jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </deployment>
        <security jcr:primaryType="nt:unstructured">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </security>
        <acs-tools jcr:primaryType="sling:OrderedFolder">
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </acs-tools>
        <acs-commons jcr:primaryType="sling:OrderedFolder"> 
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </acs-commons>
        <cloudservices jcr:primaryType="sling:Folder"> 
            <granite:rendercondition
                jcr:primaryType="nt:unstructured"
                sling:resourceType="cq/gui/components/siteadmin/admin/listview/columns/grouprendercondition"
                groups="[dam-admin,Sites-Admin,AEM Stage Admin,AEM QA Admin,AEM Dev Admin,AEM Prod Admin]"/>
        </cloudservices>
    </tools>
</jcr:root>

Create a list of groups who needed the access and then add it to the .content.xml file

[Kate_Sumbler]

From your answer it looks like this needs to be done by one of our developers and cannot be done by the User Admin using the ACL controls in Tools > Security > Permissions?

[Jagadeesh_Prakash · Accepted solution]

@Kate_Sumbler we can do it in the way you suggested. But even if we do it developer needs to find the ootb paths for the functionalities and then only Admin can edit the permissions. 

In both the cases developers are involved so i suggest to go for the option which i have suggested