NCP配置示例

禁止使用组织外的VPCEP访问SWR服务资源，但云服务发起的请求除外。

{
  "Version": "5.0",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": [
        "swr:*:*"
      ],
      "Condition": {
        "StringNotEquals": {
          "g:SourceVpceOrgId": ["<my-org-id>"]
        },
        "Bool": {
          "g:PrincipalIsService": ["false"]
        }
      }
    }
  ]
}

通过NCP限制组织内的网络只能被组织内的身份使用，云服务发起的请求例外。

{
    "Version": "5.0",
    "Statement": [
        {
            "Sid": "EnforceIdentityPerimeter",
            "Effect": "Deny",
            "Principal": "*",
	    "Action": [
                "swr:*:*"
            ],
            "Condition": {
                "StringNotEqualsIfExists": {
                    "g:PrincipalOrgId": ["<my-org-id>"]
                },
                "BoolIfExists": {
                    "g:PrincipalIsServices": ["false"]
                }
            }
        }
	]
}

通过NCP限制组织内的网络只能用于访问组织内的资源，云服务发起的请求例外。

{
    "Version": "5.0",
    "Statement": [
        {
            "Sid": "EnforceResourcePerimeter",
            "Effect": "Deny",
            "Principal": "*",
	    "Action": ["swr:*:*"],
            "NotResource": ["<system-owned-resources>"],
            "Condition": {
                "StringNotEqualsIfExists": {
                    "g:ResourceOrgId": ["<my-org-id>"]
                }
            }
        }
    ]
}