Help Center/ Organizations/ User Guide/ Managing NCPs/ Example NCPs
Updated on 2026-08-25 GMT+08:00
View PDF
Share

Example NCPs

Blocking External VPCEP Access to SWR Resources, Except for Cloud Service-Initiated Requests

The following policy blocks the access to SWR resources using a VPCEP outside the organization, except for the requests initiated by cloud services. 
{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "swr:*:*"
      ],
      "Condition": {
        "StringNotEquals": {
          "g:SourceVpceOrgId": ["<my-org-id>"]
        },
        "Bool": {
          "g:PrincipalIsService": ["false"]
        }
      }
    }
  ]
}

Restricting Networks Within the Organization to Identities Within the Organization Only, Except for Requests Initiated by Cloud Services

Use NCP to restrict networks within the organization so that they can be used only by identities within the organization, except for requests initiated by cloud services. 
{
    "Version": "5.0",
    "Statement": [
        {
            "Sid": "EnforceIdentityPerimeter",
            "Effect": "Deny",
            "Principal": "*",
	    "Action": [
                "swr:*:*"
            ],
            "Condition": {
                "StringNotEqualsIfExists": {
                    "g:PrincipalOrgId": ["<my-org-id>"]
                },
                "BoolIfExists": {
                    "g:PrincipalIsServices": ["false"]
                }
            }
        }
	]
}

Restricting the Organization's Networks to Accessing Resources Within the Organization Only, Except For Requests Initiated by Cloud Services

Use NCP to restrict networks within the organization so that they can be used only to access resources within the organization, except for requests initiated by cloud services. 
{
    "Version": "5.0",
    "Statement": [
        {
            "Sid": "EnforceResourcePerimeter",
            "Effect": "Deny",
            "Principal": "*",
	    "Action": ["swr:*:*"],
            "NotResource": ["<system-owned-resources>"],
            "Condition": {
                "StringNotEqualsIfExists": {
                    "g:ResourceOrgId": ["<my-org-id>"]
                }
            }
        }
    ]
}
Parent topic: Managing NCPs