Create AEM System user | Service user from Configuration | Ensure Service User Config

 ACS AEM Commons - Ensure Service User Configuration

Navigate to http://localhost:4502/system/console/configMgr

Search "Ensure Service User " Using this configuration service you can create the system user and apply the permission(read/write) on the folder.

You can also create the configuration in your code base to deploy the below xml file to create system user and permissions.

Configuration

Create an OSGi configuration for each service user

/apps/test-app/config/com.adobe.acs.commons.users.impl.EnsureServiceUser-testServiceUser

<?xml version="1.0" encoding="UTF-8"?>
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:cq="http://www.day.com/jcr/cq/1.0"
    xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
    jcr:primaryType="sling:OsgiConfig"
    principalName="keshav-service-user"
    operation="add"
    ensure-immediately="{Boolean}true"
    aces="[type=allow;privileges=jcr:read,jcr:all,rep:write;path=/content/we-retail,type=allow;privileges=jcr:read;path=/conf/we-retail,type=allow;privileges=jcr:read;path=/apps/weretail]"/>

Below is the full mapping AEMPermissionsToJCRPrivileges does.

"READ": ["jcr:read"]

"MODIFY": ["jcr:modifyProperties","jcr:lockManagement","jcr:versionManagement","jcr:removeChildNodes","jcr:removeNode","jcr:addChildNodes","jcr:nodeTypeManagement"]

"CREATE": ["jcr:addChildNodes","jcr:nodeTypeManagement"]

"DELETE": ["jcr:removeChildNodes","jcr:removeNode"]

"READACL": ["jcr:readAccessControl"]

"EDITACL": ["jcr:modifyAccessControl"]

"REPLICATE": ["crx:replicate"]