SCPs

Example: Forbid an account to download images from an SWR Enterprise Edition instance in a namespace.

The following describes how to configure an SCP to forbid an account to download images from the SWR Enterprise Edition instance named test-swr in the test-namespace namespace.

Configuration method

1. Log in to the management console as the organization administrator or using the management account, and navigate to the Organizations console.
2. On the Policies page, click Service control policies and then Create Policy.
3. Enter the policy name and description. On the left of the policy content, you can copy and paste the following JSON policy content: Click Save.

   {
     "Version": "5.0",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": [
           "swr:repository:downloadArtifact"
         ],
         "Resource": [
           "swr:*:*:repository:test-swr/test-namespace"
         ]
       }
     ]
   }

4. Bind the policy to an OU or account of the organization to apply the policy.
   1. Log in to Huawei Cloud as the organization administrator or using the management account, navigate to the Organizations console, and access the Organization page.
   2. Select the OU or account you want to attach the SCP to.
   3. On the details page, click the Policies tab. On the displayed tab, expand Service control policies and click Attach.
   4. Select the policy to be added and enter "Confirm" in the text box. Then, click Attach.