NCP Principles

NCP Types

NCPs are classified as either system-defined policies or custom policies, depending on who creates them.

• System-defined policies

Huawei Cloud has preset a system-defined policy named NCPFullAccess for organizations. The organization administrator can directly use the system-defined policy when attaching NCPs to OUs or accounts. Such policies cannot be modified. For details about available system-defined NCPs, see System-defined NCPs.

• Custom policies

If the system-defined policy cannot meet your authorization requirements, you can use the management account to create and modify custom policies based on the actions supported by each service. For details, see Cloud Services for Using NCPs. Custom policies extend and supplement system-defined policies. You can create custom policies for Organizations in a policy editor or JSON view.

NCP Effects on Permissions

• Layer-by-layer permissions check

  To allow an action on cloud services accessed through a member account's VPC endpoints, the action must be explicitly allowed at each level from the organization's root to each OU in the account's direct path (including the target account itself).

  Figure 1 Organizational structure example with Allow statements added to the root, OU, and account y
  

  To deny a specific account the permission to perform an action, any NCP can deny the permission from the organization's root to each OU in the account's direct path, including the target account.

  Figure 2 Organizational structure with Deny statements added to an OU and the impact on account y
  

• Allow by default

  When NCPs are enabled for an organization, the NCPFullAccess policy is attached by default to all OUs and accounts unless you attach explicit deny policies to the OUs or accounts.