Help Center/ Organizations/ User Guide/ Managing NCPs/ Overview of an NCP/ NCP Syntax
Updated on 2026-08-25 GMT+08:00
View PDF
Share

NCP Syntax

The following uses a custom policy for STS as an example to describe the policy syntax.

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "sts:agencies:assume"
      ],
      "Condition": {
        "Bool": {
          "g:PrincipalIsService": [
            "false"
          ]
        }
      }
    }
  ]
}

NCPs use a syntax basically similar to that used by IAM identity policies, but NCPs have the following constraints:

  • The Principal field is mandatory and must include only one type of principal: all identities.

    {"Statement":[{"Principal":"*"}]}

  • For user-defined NCPs, the Effect can only be set to Deny. For details, see Constraints.

Policy Structure

A policy consists of a version and a single statement or an array of individual statements, each indicating a different action.

Figure 1 Policy structure

Policy Elements

The following table describes the policy elements (Version and Statement).

Table 1 Policy elements

Element

Mandatory

Description

Value

Version

Yes

Policy version.

5.0 (cannot be customized)

Statement:

Permissions defined by a policy

Statement ID (Sid)

No

Identifier of a policy statement. You can assign a Sid value for each statement in a statement array.

A user-defined character string (including the service meaning).

Effect

Yes

Determines whether to allow or deny the operations defined in an action.
  • Deny

Principal

Yes

Principal type.

Use "Principal": "*" to include all identities.

Action

Optional for Deny statements

Operations that the policy allows or denies.

Format: "Service name:Resource type:Operation".

For example, sts:agencies:assume indicates the permission to obtain temporary security credentials for resource access, where sts refers to the service name, agencies refers to the resource type, and assume refers to the operation.

Condition

Optional for Deny statements

Determines when a policy is in effect. A condition consists of a condition key and a condition operator.

Format: "Condition operator:{Condition key:[Value 1,Value 2]}"

If you configure multiple conditions, the policy can be applied only when all the conditions are met.

Example:

"Bool":{"g: PrincipalIsService":["false"]}: The statement takes effect when the request is not initiated by a cloud service.

Resource

No

If this element is not specified, * is used by default, indicating that the policy applies to all resources.

Resources that the policy applies to.

The value can be either * or a specific resource for Deny statements. Format: Service name:region:domain ID:Resource type:Resource path. Wildcard characters (*) are supported, indicating all resources.

Example: "iam:*:*:agency:*", representing all agencies.

NotResource

No

If it is not specified, see Resource.

Resources that the policy does not apply to.

The following elements are not supported in NCPs:

  • NotPrincipal
  • NotAction

Condition Keys

A condition key is a key in the Condition element of a statement. The condition key that you specify can be a global condition key or a service-specific condition key. For details, see the condition keys supported by each service in Global Condition Keys.

Operators

A condition operator, a condition key, and a condition value together constitute a complete condition statement. A policy can be applied only when its request conditions are met. Operators can have the "IfExists" suffix added, which means the policy will take effect either if the corresponding request value does not exist or if it exists and meets the condition. For example, "StringEqualsIfExists" indicates that the policy will take effect if the request value does not exist or if it equals the condition value. For details, see Operators.

Parent topic: Overview of an NCP