Creating an NCP

Constraints

• Effect in a custom NCP can only be set to Deny.
• Only Action is supported. NotAction is not supported.
• Only the names of cloud services for using NCPs are supported as Action prefixes, for example, Action="swr:*:*". Wildcards (*) are not supported, for example, Action="*" or Action="*:*:*". For the list of cloud services supported by NCP, see Cloud Services for Using NCPs.
• An action in a custom NCP must contain three fields and have the following structure:

  "service-name:type-name:action-name"

Procedure

1. Log in to the Organizations console as an organization administrator or using the management account.
2. On the Policies page, click Network control policies.
   Figure 1 Accessing the Network control policies page
   

3. Click Create Policy.
   Figure 2 Creating an NCP
   

4. Enter a unique policy name.

   (Optional) You can also enter a description for the policy.

   

5. On the left of the policy content, edit the policy content in JSON.

   For details about how to build JSON policy statements, see NCP Syntax and Example NCPs.

   

   

   The Version value of a custom policy must be 5.0.

6. Hover over the statement on the left of the policy content and edit the actions, resources, and conditions of the custom policy in the policy editor on the right.
   

   • Adding an action: Click and select or search for the service and action to be added. The added action will be displayed in Action on the left of the policy content. Figure 3 shows the details.
     Figure 3 Adding an action
     
   • Adding a resource: Only services available for resource-level authorization can be added. You can click to select a service and resource type and enter the URN as required. Figure 4 shows the details.
     Figure 4 Adding a resource
     
   • (Optional) Adding a condition: Click to add a condition key and operator to specify the conditions for the policy to take effect. Figure 5 shows the details.
     Figure 5 Adding a condition
     

7. (Optional) Click Add Statement to add an object for the Statement element.

   The value for the Statement element can be an array of multiple objects that identify different permissions.

   Figure 6 Adding a statement
   

8. (Optional) Add one or more tags. Enter a tag key and a tag value, and click Add.
   Figure 7 Adding tags to the NCP
   

9. Click Save. If the policy list is displayed, the NCP is created successfully. If a message appears indicating incorrect policy content, modify the NCP syntax.