SCPs

This section uses an example to describe how to configure SCPs.

Example: Forbid an account to download images in an organization.

The following describes how to configure an SCP to forbid an account in an organization in the Organizations service to download images from the test-repo image repository in the test-namespace organization of SWR.

Configuration method

1. Log in to the management console as the organization administrator or using the management account, and navigate to the Organizations console.
2. On the Policies page, click Service control policies and then Create Policy.
3. Enter the policy name and description. On the left of the policy content, you can copy and paste the JSON policy content below. Click Save.

   {
     "Version": "5.0",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": [
           "swr:repo:download"
         ],
         "Resource": [
           "swr:*:*:repo:test-namespace/test-repo"
         ]
       }
     ]
   }

4. Bind the policy to an OU or account of the organization to apply the policy.
   1. Log in to Huawei Cloud as the organization administrator or using the management account, navigate to the Organizations console, and access the Organization page.
   2. Select the OU or account you want to attach the SCP to.
   3. On the details page, click the Policies tab. On the displayed tab, expand Service control policies and click Attach.
   4. Select the policy to be added and enter "Confirm" in the text box. Then, click Attach.