Help Center/ Organizations/ User Guide/ Managing SCPs/ Creating an SCP
Updated on 2026-07-24 GMT+08:00
View PDF
Share

Creating an SCP

Scenarios

Global permission control policies enable the centralized management of account permissions within an organization. These policies ensure the strict separation of operational permissions among accounts, facilitating unified control over permission isolation and compliance baselines.

This section describes how to create a custom SCP. For common SCP examples, see Example SCPs.

Constraints

  • Effect in a custom SCP can only be set to Deny.
  • Only Action is supported. NotAction is not supported.
  • The action prefix must be the name of a cloud service that has been interconnected with IAM 5.0, for example, Action="ram:*:*". Wildcards (*) are not supported for prefixes. For example, Action="*" or Action="*:*:*" is not allowed.
  • An action in a custom SCP must contain three fields and have the following structure:

    "service-name:type-name:action-name"

  • SCPs cannot be attached to the organization administrator.

Procedure

  1. Log in to the Organizations console as an organization administrator or using the management account.
  2. On the Policies page, click Service control policies.

    Figure 1 Accessing the Service control policies page

  3. Click the Live or Dry-Run tab and click Create Policy.

    Figure 2 Creating an SCP

  4. Enter a policy name. The policy name must be unique. Only letters, digits, spaces, hyphens (-), and underscores (_) are supported. The policy name cannot start or end with a space. A maximum of 64 characters.

    (Optional) You can also enter a description for the policy.

  5. On the left of the policy content, edit the policy content in JSON.

    For details about how to build JSON policy statements, see SCP Syntax and Example SCPs.

    The Version value of a custom policy must be 5.0.

  6. Hover over the statement on the left of the policy content and edit the actions, resources, and conditions of the custom policy in the policy editor on the right.

    • Adding an action: Click and select or search for the service and action to be added. The added action will be displayed in Action on the left of the policy content. Figure 3 shows the details.
      Figure 3 Adding an action
    • Adding a resource: Only services available for resource-level authorization can be added. You can click to select a service and resource type and enter the URN as required. Figure 4 shows the details.
      Figure 4 Adding a resource
    • (Optional) Adding a condition: Click to add a condition key and operator to specify the conditions for the policy to take effect. Figure 5 shows the details.
      Figure 5 Adding a condition

  7. (Optional) Click Add Statement to add an object for the Statement element.

    The value for the Statement element can be an array of multiple objects that identify different permissions.

    Figure 6 Adding a statement

  8. (Optional) Add one or more tags. In the Tags area, Click Add, and specify the tag key and value.

    Figure 7 Adding tags to the SCP

  9. Click Save. If the policy list is displayed, the SCP is created successfully. If a message appears indicating incorrect policy content, modify the SCP syntax.

    • You can use dry-run policies to simulate permissions management across all member accounts in an organization and check if the SCPs can meet your requirements based on dry-run logs.
    • Dry-run policies do not change any actual permissions of all accounts.

Helpful Links

Parent topic: Managing SCPs