SCPs

This section uses an example to describe how to configure SCPs.

Example: Forbid an account to download images in an organization.

The following describes how to configure an SCP to forbid an account in an organization in the Organizations service to download images from the test-repo image repository in the test-namespace organization of SWR.

Configuration method

1. Log in to the Organizations console as an organization administrator or using a management account.
2. On the Policies page, click Service control policies and then Create Policy.
3. Enter the policy name and description. On the left of the policy content, you can copy and paste the JSON policy content below. Click Save.

   {
     "Version": "5.0",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": [
           "swr:repo:download"
         ],
         "Resource": [
           "swr:*:*:repo:test-namespace/test-repo"
         ]
       }
     ]
   }

4. Bind the policy to an OU or account of the organization to apply the policy.
   1. Log in to the Organizations console as an organization administrator or using a management account.
   2. Select the OU or account you want to attach the SCP to.
   3. On the details page, click the Policies tab. On the displayed tab, expand Service control policies and click Attach.
   4. Select the policy to be added and enter "Confirm" in the text box. Then, click Attach.