SCPs

Example: Forbid an account to download images from an SWR Enterprise Edition instance in a namespace.

The following describes how to configure an SCP to forbid an account to download images from the SWR Enterprise Edition instance named test-swr in the test-namespace namespace.

Configuration method

1. Log in to the Organizations console as an organization administrator or using a management account.
2. On the Policies page, click Service control policies and then Create Policy.
3. Enter the policy name and description. On the left of the policy content, you can copy and paste the JSON policy content below. Click Save.

   {
     "Version": "5.0",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": [
           "swr:repository:downloadArtifact"
         ],
         "Resource": [
           "swr:*:*:repository:test-swr/test-namespace"
         ]
       }
     ]
   }

4. Bind the policy to an OU or account of the organization to apply the policy.
   1. Log in to the Organizations console as an organization administrator or using a management account.
   2. Select the OU or account you want to attach the SCP to.
   3. On the details page, click the Policies tab. On the displayed tab, expand Service control policies and click Attach.
   4. Select the policy to be added and enter "Confirm" in the text box. Then, click Attach.