OrgPolicyPolicy

This resource configures organization policy constraints for a project, folder, or organization. Set exactly one of projectRef, folderRef, or organizationRef to select the parent resource.

Property	Value
Google Cloud Service Name	Organization Policy
Google Cloud Service Documentation	/resource-manager/docs/organization-policy/overview
Google Cloud REST Resource Name	organizations.policies
Google Cloud REST Resource Documentation	/resource-manager/docs/reference/orgpolicy/rest/v2/organizations.policies
Config Connector Resource Short Names	gcporgpolicypolicies gcporgpolicypolicy orgpolicypolicy
Config Connector Service Name	orgpolicy.googleapis.com
Config Connector Resource Fully Qualified Name	orgpolicypolicies.orgpolicy.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember	No
Config Connector Default Average Reconcile Interval In Seconds	600

Custom Resource Definition Properties

Spec

Schema

dryRunSpec:
  inheritFromParent: boolean
  reset: boolean
  rules:
  - allowAll: boolean
    condition:
      description: string
      expression: string
      location: string
      title: string
    denyAll: boolean
    enforce: boolean
    parameters:
      allowAnyGKEPath: boolean
      allowPaths:
      - string
      allowedAWSAccountIDs:
      - string
      allowedDataSources:
      - string
      allowedDomains:
      - string
      allowedEgressFQDNs:
      - string
      allowedEncryptions:
      - string
      allowedMemberSubjects:
      - string
      allowedParents:
      - string
      allowedPreviewFeatures:
      - string
      allowedPrincipalSets:
      - string
      allowedProviders:
      - string
      allowedRetentionDurationSeconds: integer
      allowedRetentionPeriods:
      - string
      allowedSchemes:
      - string
      allowedServiceList:
      - string
      allowedServices:
      - string
      defaultAWSProvider: string
      defaultXMLServiceProvider: string
      deniedEditions:
      - string
      enforcedProjects:
      - string
      minimumDestroyScheduleDurationInDays: integer
      nonFIPSMachineTypes:
      - string
    values:
      allowedValues:
      - string
      deniedValues:
      - string
folderRef:
  external: string
  name: string
  namespace: string
organizationRef:
  external: string
projectRef:
  external: string
  kind: string
  name: string
  namespace: string
resourceID: string
spec:
  inheritFromParent: boolean
  reset: boolean
  rules:
  - allowAll: boolean
    condition:
      description: string
      expression: string
      location: string
      title: string
    denyAll: boolean
    enforce: boolean
    parameters:
      allowAnyGKEPath: boolean
      allowPaths:
      - string
      allowedAWSAccountIDs:
      - string
      allowedDataSources:
      - string
      allowedDomains:
      - string
      allowedEgressFQDNs:
      - string
      allowedEncryptions:
      - string
      allowedMemberSubjects:
      - string
      allowedParents:
      - string
      allowedPreviewFeatures:
      - string
      allowedPrincipalSets:
      - string
      allowedProviders:
      - string
      allowedRetentionDurationSeconds: integer
      allowedRetentionPeriods:
      - string
      allowedSchemes:
      - string
      allowedServiceList:
      - string
      allowedServices:
      - string
      defaultAWSProvider: string
      defaultXMLServiceProvider: string
      deniedEditions:
      - string
      enforcedProjects:
      - string
      minimumDestroyScheduleDurationInDays: integer
      nonFIPSMachineTypes:
      - string
    values:
      allowedValues:
      - string
      deniedValues:
      - string

Fields
dryRunSpec Optional	object Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it's enforced.
dryRunSpec.inheritFromParent Optional	boolean Determines the inheritance behavior for this policy. If `inherit_from_parent` is true, policy rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the new root for evaluation. This field can be set only for policies which configure list constraints.
dryRunSpec.reset Optional	boolean Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
dryRunSpec.rules Optional	list (object) In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence.
dryRunSpec.rules[] Optional	object
dryRunSpec.rules[].allowAll Optional	boolean Setting this to true means that all values are allowed. This field can be set only in policies for list constraints.
dryRunSpec.rules[].condition Optional	object A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
dryRunSpec.rules[].condition.description Optional	string Optional. Description of the expression. This is a longer text which describes the expression, for example, when hovered over it in a UI.
dryRunSpec.rules[].condition.expression Optional	string Textual representation of an expression in Common Expression Language syntax.
dryRunSpec.rules[].condition.location Optional	string Optional. String indicating the location of the expression for error reporting, for example, a file name and a position in the file.
dryRunSpec.rules[].condition.title Optional	string Optional. Title for the expression, i.e. a short string describing its purpose. This can be used, for example, in UIs which allow to enter the expression.
dryRunSpec.rules[].denyAll Optional	boolean Setting this to true means that all values are denied. This field can be set only in policies for list constraints.
dryRunSpec.rules[].enforce Optional	boolean If `true`, then the policy is enforced. If `false`, then any configuration is acceptable. This field can be set only in policies for boolean constraints.
dryRunSpec.rules[].parameters Optional	object Optional. Required for managed constraints if parameters are defined. Passes parameter values when policy enforcement is enabled. Each field corresponds to a known managed-constraint parameter key; the value type matches the type defined in the constraint definition. For example, the essentialcontacts.managed.allowedContactDomains managed constraint takes: parameters: allowedDomains: - "@example.com"
dryRunSpec.rules[].parameters.allowAnyGKEPath Optional	boolean When true, any Google Kubernetes Engine resource path is permitted.
dryRunSpec.rules[].parameters.allowPaths Optional	list (string) Resource paths that are explicitly allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowPaths[] Optional	string
dryRunSpec.rules[].parameters.allowedAWSAccountIDs Optional	list (string) AWS account IDs that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedAWSAccountIDs[] Optional	string
dryRunSpec.rules[].parameters.allowedDataSources Optional	list (string) Data sources that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedDataSources[] Optional	string
dryRunSpec.rules[].parameters.allowedDomains Optional	list (string) Contact domains that are allowed by the managed constraint (for example, email domains permitted by essentialcontacts.managed.allowedContactDomains).
dryRunSpec.rules[].parameters.allowedDomains[] Optional	string
dryRunSpec.rules[].parameters.allowedEgressFQDNs Optional	list (string) Fully qualified domain names that are allowed for egress traffic.
dryRunSpec.rules[].parameters.allowedEgressFQDNs[] Optional	string
dryRunSpec.rules[].parameters.allowedEncryptions Optional	list (string) Encryption types or modes that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedEncryptions[] Optional	string
dryRunSpec.rules[].parameters.allowedMemberSubjects Optional	list (string) Member subjects (for example, users or service accounts) that are allowed.
dryRunSpec.rules[].parameters.allowedMemberSubjects[] Optional	string
dryRunSpec.rules[].parameters.allowedParents Optional	list (string) Parent resources (organizations, folders, or projects) that are allowed.
dryRunSpec.rules[].parameters.allowedParents[] Optional	string
dryRunSpec.rules[].parameters.allowedPreviewFeatures Optional	list (string) Preview features that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedPreviewFeatures[] Optional	string
dryRunSpec.rules[].parameters.allowedPrincipalSets Optional	list (string) Principal sets that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedPrincipalSets[] Optional	string
dryRunSpec.rules[].parameters.allowedProviders Optional	list (string) Providers that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedProviders[] Optional	string
dryRunSpec.rules[].parameters.allowedRetentionDurationSeconds Optional	integer Retention durations (in seconds) that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedRetentionPeriods Optional	list (string) Retention periods that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedRetentionPeriods[] Optional	string
dryRunSpec.rules[].parameters.allowedSchemes Optional	list (string) URI schemes that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedSchemes[] Optional	string
dryRunSpec.rules[].parameters.allowedServiceList Optional	list (string) Services that are allowed by the managed constraint (service list form).
dryRunSpec.rules[].parameters.allowedServiceList[] Optional	string
dryRunSpec.rules[].parameters.allowedServices Optional	list (string) Services that are allowed by the managed constraint.
dryRunSpec.rules[].parameters.allowedServices[] Optional	string
dryRunSpec.rules[].parameters.defaultAWSProvider Optional	string Default AWS provider used when no explicit provider is specified.
dryRunSpec.rules[].parameters.defaultXMLServiceProvider Optional	string Default XML service provider used when no explicit provider is specified.
dryRunSpec.rules[].parameters.deniedEditions Optional	list (string) Editions that are denied by the managed constraint.
dryRunSpec.rules[].parameters.deniedEditions[] Optional	string
dryRunSpec.rules[].parameters.enforcedProjects Optional	list (string) Projects where the managed constraint is enforced.
dryRunSpec.rules[].parameters.enforcedProjects[] Optional	string
dryRunSpec.rules[].parameters.minimumDestroyScheduleDurationInDays Optional	integer Minimum destroy schedule duration, in days, required by the managed constraint.
dryRunSpec.rules[].parameters.nonFIPSMachineTypes Optional	list (string) Compute Engine machine types that are not FIPS-compliant but are allowed.
dryRunSpec.rules[].parameters.nonFIPSMachineTypes[] Optional	string
dryRunSpec.rules[].values Optional	object List of values to be used for this policy rule. This field can be set only in policies for list constraints.
dryRunSpec.rules[].values.allowedValues Optional	list (string) List of values allowed at this resource.
dryRunSpec.rules[].values.allowedValues[] Optional	string
dryRunSpec.rules[].values.deniedValues Optional	list (string) List of values denied at this resource.
dryRunSpec.rules[].values.deniedValues[] Optional	string
folderRef Optional	object Immutable. The Folder that this resource belongs to. One and only one of 'projectRef', 'folderRef', or 'organizationRef' must be set.
folderRef.external Optional	string The 'name' field of a folder, when not managed by Config Connector. This field must be set when 'name' field is not set.
folderRef.name Optional	string The 'name' field of a 'Folder' resource. This field must be set when 'external' field is not set.
folderRef.namespace Optional	string The 'namespace' field of a 'Folder' resource. If unset, the namespace is defaulted to the namespace of the referencer resource.
organizationRef Optional	object Immutable. The Organization that this resource belongs to. One and only one of 'projectRef', 'folderRef', or 'organizationRef' must be set.
organizationRef.external Required*	string The 'name' field of an organization, when not managed by Config Connector.
projectRef Optional	object Immutable. The Project that this resource belongs to. One and only one of 'projectRef', 'folderRef', or 'organizationRef' must be set.
projectRef.external Optional	string The `projectID` field of a project, when not managed by Config Connector.
projectRef.kind Optional	string The kind of the Project resource; optional but must be `Project` if provided.
projectRef.name Optional	string The `name` field of a `Project` resource.
projectRef.namespace Optional	string The `namespace` field of a `Project` resource.
resourceID Optional	string The OrgPolicyPolicy name. If not given, the metadata.name will be used.
spec Optional	object Basic information about the Organization Policy.
spec.inheritFromParent Optional	boolean Determines the inheritance behavior for this policy. If `inherit_from_parent` is true, policy rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the new root for evaluation. This field can be set only for policies which configure list constraints.
spec.reset Optional	boolean Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.
spec.rules Optional	list (object) In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence.
spec.rules[] Optional	object
spec.rules[].allowAll Optional	boolean Setting this to true means that all values are allowed. This field can be set only in policies for list constraints.
spec.rules[].condition Optional	object A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
spec.rules[].condition.description Optional	string Optional. Description of the expression. This is a longer text which describes the expression, for example, when hovered over it in a UI.
spec.rules[].condition.expression Optional	string Textual representation of an expression in Common Expression Language syntax.
spec.rules[].condition.location Optional	string Optional. String indicating the location of the expression for error reporting, for example, a file name and a position in the file.
spec.rules[].condition.title Optional	string Optional. Title for the expression, i.e. a short string describing its purpose. This can be used, for example, in UIs which allow to enter the expression.
spec.rules[].denyAll Optional	boolean Setting this to true means that all values are denied. This field can be set only in policies for list constraints.
spec.rules[].enforce Optional	boolean If `true`, then the policy is enforced. If `false`, then any configuration is acceptable. This field can be set only in policies for boolean constraints.
spec.rules[].parameters Optional	object Optional. Required for managed constraints if parameters are defined. Passes parameter values when policy enforcement is enabled. Each field corresponds to a known managed-constraint parameter key; the value type matches the type defined in the constraint definition. For example, the essentialcontacts.managed.allowedContactDomains managed constraint takes: parameters: allowedDomains: - "@example.com"
spec.rules[].parameters.allowAnyGKEPath Optional	boolean When true, any Google Kubernetes Engine resource path is permitted.
spec.rules[].parameters.allowPaths Optional	list (string) Resource paths that are explicitly allowed by the managed constraint.
spec.rules[].parameters.allowPaths[] Optional	string
spec.rules[].parameters.allowedAWSAccountIDs Optional	list (string) AWS account IDs that are allowed by the managed constraint.
spec.rules[].parameters.allowedAWSAccountIDs[] Optional	string
spec.rules[].parameters.allowedDataSources Optional	list (string) Data sources that are allowed by the managed constraint.
spec.rules[].parameters.allowedDataSources[] Optional	string
spec.rules[].parameters.allowedDomains Optional	list (string) Contact domains that are allowed by the managed constraint (for example, email domains permitted by essentialcontacts.managed.allowedContactDomains).
spec.rules[].parameters.allowedDomains[] Optional	string
spec.rules[].parameters.allowedEgressFQDNs Optional	list (string) Fully qualified domain names that are allowed for egress traffic.
spec.rules[].parameters.allowedEgressFQDNs[] Optional	string
spec.rules[].parameters.allowedEncryptions Optional	list (string) Encryption types or modes that are allowed by the managed constraint.
spec.rules[].parameters.allowedEncryptions[] Optional	string
spec.rules[].parameters.allowedMemberSubjects Optional	list (string) Member subjects (for example, users or service accounts) that are allowed.
spec.rules[].parameters.allowedMemberSubjects[] Optional	string
spec.rules[].parameters.allowedParents Optional	list (string) Parent resources (organizations, folders, or projects) that are allowed.
spec.rules[].parameters.allowedParents[] Optional	string
spec.rules[].parameters.allowedPreviewFeatures Optional	list (string) Preview features that are allowed by the managed constraint.
spec.rules[].parameters.allowedPreviewFeatures[] Optional	string
spec.rules[].parameters.allowedPrincipalSets Optional	list (string) Principal sets that are allowed by the managed constraint.
spec.rules[].parameters.allowedPrincipalSets[] Optional	string
spec.rules[].parameters.allowedProviders Optional	list (string) Providers that are allowed by the managed constraint.
spec.rules[].parameters.allowedProviders[] Optional	string
spec.rules[].parameters.allowedRetentionDurationSeconds Optional	integer Retention durations (in seconds) that are allowed by the managed constraint.
spec.rules[].parameters.allowedRetentionPeriods Optional	list (string) Retention periods that are allowed by the managed constraint.
spec.rules[].parameters.allowedRetentionPeriods[] Optional	string
spec.rules[].parameters.allowedSchemes Optional	list (string) URI schemes that are allowed by the managed constraint.
spec.rules[].parameters.allowedSchemes[] Optional	string
spec.rules[].parameters.allowedServiceList Optional	list (string) Services that are allowed by the managed constraint (service list form).
spec.rules[].parameters.allowedServiceList[] Optional	string
spec.rules[].parameters.allowedServices Optional	list (string) Services that are allowed by the managed constraint.
spec.rules[].parameters.allowedServices[] Optional	string
spec.rules[].parameters.defaultAWSProvider Optional	string Default AWS provider used when no explicit provider is specified.
spec.rules[].parameters.defaultXMLServiceProvider Optional	string Default XML service provider used when no explicit provider is specified.
spec.rules[].parameters.deniedEditions Optional	list (string) Editions that are denied by the managed constraint.
spec.rules[].parameters.deniedEditions[] Optional	string
spec.rules[].parameters.enforcedProjects Optional	list (string) Projects where the managed constraint is enforced.
spec.rules[].parameters.enforcedProjects[] Optional	string
spec.rules[].parameters.minimumDestroyScheduleDurationInDays Optional	integer Minimum destroy schedule duration, in days, required by the managed constraint.
spec.rules[].parameters.nonFIPSMachineTypes Optional	list (string) Compute Engine machine types that are not FIPS-compliant but are allowed.
spec.rules[].parameters.nonFIPSMachineTypes[] Optional	string
spec.rules[].values Optional	object List of values to be used for this policy rule. This field can be set only in policies for list constraints.
spec.rules[].values.allowedValues Optional	list (string) List of values allowed at this resource.
spec.rules[].values.allowedValues[] Optional	string
spec.rules[].values.deniedValues Optional	list (string) List of values denied at this resource.
spec.rules[].values.deniedValues[] Optional	string

* Field is required when parent field is specified

Status

Schema

conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
externalRef: string
observedGeneration: integer
observedState:
  dryRunSpec:
    updateTime: string
  spec:
    updateTime: string

Fields
conditions	list (object) Conditions represent the latest available observations of the object's current state.
conditions[]	object
conditions[].lastTransitionTime	string Last time the condition transitioned from one status to another.
conditions[].message	string Human-readable message indicating details about last transition.
conditions[].reason	string Unique, one-word, CamelCase reason for the condition's last transition.
conditions[].status	string Status is the status of the condition. Can be True, False, Unknown.
conditions[].type	string Type is the type of the condition.
externalRef	string A unique specifier for the OrgPolicyPolicy resource in Google Cloud.
observedGeneration	integer ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
observedState	object ObservedState is the state of the resource as most recently observed in Google Cloud.
observedState.dryRunSpec	object Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it's enforced.
observedState.dryRunSpec.updateTime	string Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.
observedState.spec	object Basic information about the Organization Policy.
observedState.spec.updateTime	string Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.

Note: If you have any trouble with instantiating the resource, refer to Troubleshoot Config Connector.