OrgPolicyPolicy

dryRunSpec.rules[].allowAll

Optional

boolean

Setting this to true means that all values are allowed. This field can be set only in policies for list constraints.

dryRunSpec.rules[].condition

Optional

object

A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag(' /tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".

dryRunSpec.rules[].condition.description

Optional

string

Optional. Description of the expression. This is a longer text which describes the expression, for example, when hovered over it in a UI.

dryRunSpec.rules[].condition.expression

Optional

string

Textual representation of an expression in Common Expression Language syntax.

dryRunSpec.rules[].condition.location

Optional

string

Optional. String indicating the location of the expression for error reporting, for example, a file name and a position in the file.

dryRunSpec.rules[].condition.title

Optional

string

Optional. Title for the expression, i.e. a short string describing its purpose. This can be used, for example, in UIs which allow to enter the expression.

dryRunSpec.rules[].denyAll

Optional

boolean

Setting this to true means that all values are denied. This field can be set only in policies for list constraints.

dryRunSpec.rules[].enforce

Optional

boolean

If `true`, then the policy is enforced. If `false`, then any configuration is acceptable. This field can be set only in policies for boolean constraints.

dryRunSpec.rules[].parameters

Optional

object

Optional. Required for managed constraints if parameters are defined. Passes parameter values when policy enforcement is enabled. Each field corresponds to a known managed-constraint parameter key; the value type matches the type defined in the constraint definition. For example, the essentialcontacts.managed.allowedContactDomains managed constraint takes: parameters: allowedDomains: - "@example.com"

dryRunSpec.rules[].parameters.allowAnyGKEPath

Optional

boolean

When true, any Google Kubernetes Engine resource path is permitted.

dryRunSpec.rules[].parameters.allowPaths

Optional

list (string)

Resource paths that are explicitly allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowPaths[]

Optional

string

dryRunSpec.rules[].parameters.allowedAWSAccountIDs

Optional

list (string)

AWS account IDs that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedAWSAccountIDs[]

Optional

string

dryRunSpec.rules[].parameters.allowedDataSources

Optional

list (string)

Data sources that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedDataSources[]

Optional

string

dryRunSpec.rules[].parameters.allowedDomains

Optional

list (string)

Contact domains that are allowed by the managed constraint (for example, email domains permitted by essentialcontacts.managed.allowedContactDomains).

dryRunSpec.rules[].parameters.allowedDomains[]

Optional

string

dryRunSpec.rules[].parameters.allowedEgressFQDNs

Optional

list (string)

Fully qualified domain names that are allowed for egress traffic.

dryRunSpec.rules[].parameters.allowedEgressFQDNs[]

Optional

string

dryRunSpec.rules[].parameters.allowedEncryptions

Optional

list (string)

Encryption types or modes that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedEncryptions[]

Optional

string

dryRunSpec.rules[].parameters.allowedMemberSubjects

Optional

list (string)

Member subjects (for example, users or service accounts) that are allowed.

dryRunSpec.rules[].parameters.allowedMemberSubjects[]

Optional

string

dryRunSpec.rules[].parameters.allowedParents

Optional

list (string)

Parent resources (organizations, folders, or projects) that are allowed.

dryRunSpec.rules[].parameters.allowedParents[]

Optional

string

dryRunSpec.rules[].parameters.allowedPreviewFeatures

Optional

list (string)

Preview features that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedPreviewFeatures[]

Optional

string

dryRunSpec.rules[].parameters.allowedPrincipalSets

Optional

list (string)

Principal sets that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedPrincipalSets[]

Optional

string

dryRunSpec.rules[].parameters.allowedProviders

Optional

list (string)

Providers that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedProviders[]

Optional

string

dryRunSpec.rules[].parameters.allowedRetentionDurationSeconds

Optional

integer

Retention durations (in seconds) that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedRetentionPeriods

Optional

list (string)

Retention periods that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedRetentionPeriods[]

Optional

string

dryRunSpec.rules[].parameters.allowedSchemes

Optional

list (string)

URI schemes that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedSchemes[]

Optional

string

dryRunSpec.rules[].parameters.allowedServiceList

Optional

list (string)

Services that are allowed by the managed constraint (service list form).

dryRunSpec.rules[].parameters.allowedServiceList[]

Optional

string

dryRunSpec.rules[].parameters.allowedServices

Optional

list (string)

Services that are allowed by the managed constraint.

dryRunSpec.rules[].parameters.allowedServices[]

Optional

string

dryRunSpec.rules[].parameters.defaultAWSProvider

Optional

string

Default AWS provider used when no explicit provider is specified.

dryRunSpec.rules[].parameters.defaultXMLServiceProvider

Optional

string

Default XML service provider used when no explicit provider is specified.

dryRunSpec.rules[].parameters.deniedEditions

Optional

list (string)

Editions that are denied by the managed constraint.

dryRunSpec.rules[].parameters.deniedEditions[]

Optional

string

dryRunSpec.rules[].parameters.enforcedProjects

Optional

list (string)

Projects where the managed constraint is enforced.

dryRunSpec.rules[].parameters.enforcedProjects[]

Optional

string

dryRunSpec.rules[].parameters.minimumDestroyScheduleDurationInDays

Optional

integer

Minimum destroy schedule duration, in days, required by the managed constraint.

dryRunSpec.rules[].parameters.nonFIPSMachineTypes

Optional

list (string)

Compute Engine machine types that are not FIPS-compliant but are allowed.

dryRunSpec.rules[].parameters.nonFIPSMachineTypes[]

Optional

string

dryRunSpec.rules[].values

Optional

object

List of values to be used for this policy rule. This field can be set only in policies for list constraints.

dryRunSpec.rules[].values.allowedValues

Optional

list (string)

List of values allowed at this resource.

dryRunSpec.rules[].values.allowedValues[]

Optional

string

dryRunSpec.rules[].values.deniedValues

Optional

list (string)

List of values denied at this resource.

dryRunSpec.rules[].values.deniedValues[]

Optional

string

folderRef

Optional

object

Immutable. The Folder that this resource belongs to. One and only one of 'projectRef', 'folderRef', or 'organizationRef' must be set.

folderRef.external

Optional

string

The 'name' field of a folder, when not managed by Config Connector. This field must be set when 'name' field is not set.

folderRef.name

Optional

string

The 'name' field of a 'Folder' resource. This field must be set when 'external' field is not set.

folderRef.namespace

Optional

string

The 'namespace' field of a 'Folder' resource. If unset, the namespace is defaulted to the namespace of the referencer resource.

organizationRef

Optional

object

Immutable. The Organization that this resource belongs to. One and only one of 'projectRef', 'folderRef', or 'organizationRef' must be set.

organizationRef.external

Required*

string

The 'name' field of an organization, when not managed by Config Connector.

projectRef

Optional

object

Immutable. The Project that this resource belongs to. One and only one of 'projectRef', 'folderRef', or 'organizationRef' must be set.

projectRef.external

Optional

string

The `projectID` field of a project, when not managed by Config Connector.

projectRef.kind

Optional

string

The kind of the Project resource; optional but must be `Project` if provided.

projectRef.name

Optional

string

The `name` field of a `Project` resource.

projectRef.namespace

Optional

string

The `namespace` field of a `Project` resource.

resourceID

Optional

string

The OrgPolicyPolicy name. If not given, the metadata.name will be used.

spec

Optional

object

Basic information about the Organization Policy.

spec.inheritFromParent

Optional

boolean

Determines the inheritance behavior for this policy. If `inherit_from_parent` is true, policy rules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this policy becomes the new root for evaluation. This field can be set only for policies which configure list constraints.

spec.reset

Optional

boolean

Ignores policies set above this resource and restores the `constraint_default` enforcement behavior of the specific constraint at this resource. This field can be set in policies for either list or boolean constraints. If set, `rules` must be empty and `inherit_from_parent` must be set to false.

spec.rules

Optional

list (object)

In policies for boolean constraints, the following requirements apply: - There must be one and only one policy rule where condition is unset. - Boolean policy rules with conditions must set `enforced` to the opposite of the policy rule without a condition. - During policy evaluation, policy rules with conditions that are true for a target resource take precedence.

spec.rules[]

Optional

object

spec.rules[].allowAll

Optional

boolean

Setting this to true means that all values are allowed. This field can be set only in policies for list constraints.

spec.rules[].condition

Optional

object

A condition which determines whether this rule is used in the evaluation of the policy. When set, the `expression` field in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag(' /tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".

spec.rules[].condition.description

Optional

string

Optional. Description of the expression. This is a longer text which describes the expression, for example, when hovered over it in a UI.

spec.rules[].condition.expression

Optional

string

Textual representation of an expression in Common Expression Language syntax.

spec.rules[].condition.location

Optional

string

Optional. String indicating the location of the expression for error reporting, for example, a file name and a position in the file.

spec.rules[].condition.title

Optional

string

Optional. Title for the expression, i.e. a short string describing its purpose. This can be used, for example, in UIs which allow to enter the expression.

spec.rules[].denyAll

Optional

boolean

Setting this to true means that all values are denied. This field can be set only in policies for list constraints.

spec.rules[].enforce

Optional

boolean

If `true`, then the policy is enforced. If `false`, then any configuration is acceptable. This field can be set only in policies for boolean constraints.

spec.rules[].parameters

Optional

object

Optional. Required for managed constraints if parameters are defined. Passes parameter values when policy enforcement is enabled. Each field corresponds to a known managed-constraint parameter key; the value type matches the type defined in the constraint definition. For example, the essentialcontacts.managed.allowedContactDomains managed constraint takes: parameters: allowedDomains: - "@example.com"

spec.rules[].parameters.allowAnyGKEPath

Optional

boolean

When true, any Google Kubernetes Engine resource path is permitted.

spec.rules[].parameters.allowPaths

Optional

list (string)

Resource paths that are explicitly allowed by the managed constraint.

spec.rules[].parameters.allowPaths[]

Optional

string

spec.rules[].parameters.allowedAWSAccountIDs

Optional

list (string)

AWS account IDs that are allowed by the managed constraint.

spec.rules[].parameters.allowedAWSAccountIDs[]

Optional

string

spec.rules[].parameters.allowedDataSources

Optional

list (string)

Data sources that are allowed by the managed constraint.

spec.rules[].parameters.allowedDataSources[]

Optional

string

spec.rules[].parameters.allowedDomains

Optional

list (string)

Contact domains that are allowed by the managed constraint (for example, email domains permitted by essentialcontacts.managed.allowedContactDomains).

spec.rules[].parameters.allowedDomains[]

Optional

string

spec.rules[].parameters.allowedEgressFQDNs

Optional

list (string)

Fully qualified domain names that are allowed for egress traffic.

spec.rules[].parameters.allowedEgressFQDNs[]

Optional

string

spec.rules[].parameters.allowedEncryptions

Optional

list (string)

Encryption types or modes that are allowed by the managed constraint.

spec.rules[].parameters.allowedEncryptions[]

Optional

string

spec.rules[].parameters.allowedMemberSubjects

Optional

list (string)

Member subjects (for example, users or service accounts) that are allowed.

spec.rules[].parameters.allowedMemberSubjects[]

Optional

string

spec.rules[].parameters.allowedParents

Optional

list (string)

Parent resources (organizations, folders, or projects) that are allowed.

spec.rules[].parameters.allowedParents[]

Optional

string

spec.rules[].parameters.allowedPreviewFeatures

Optional

list (string)

Preview features that are allowed by the managed constraint.

spec.rules[].parameters.allowedPreviewFeatures[]

Optional

string

spec.rules[].parameters.allowedPrincipalSets

Optional

list (string)

Principal sets that are allowed by the managed constraint.

spec.rules[].parameters.allowedPrincipalSets[]

Optional

string

spec.rules[].parameters.allowedProviders

Optional

list (string)

Providers that are allowed by the managed constraint.

spec.rules[].parameters.allowedProviders[]

Optional

string

spec.rules[].parameters.allowedRetentionDurationSeconds

Optional

integer

Retention durations (in seconds) that are allowed by the managed constraint.

spec.rules[].parameters.allowedRetentionPeriods

Optional

list (string)

Retention periods that are allowed by the managed constraint.

spec.rules[].parameters.allowedRetentionPeriods[]

Optional

string

spec.rules[].parameters.allowedSchemes

Optional

list (string)

URI schemes that are allowed by the managed constraint.

spec.rules[].parameters.allowedSchemes[]

Optional

string

spec.rules[].parameters.allowedServiceList

Optional

list (string)

Services that are allowed by the managed constraint (service list form).

spec.rules[].parameters.allowedServiceList[]

Optional

string

spec.rules[].parameters.allowedServices

Optional

list (string)

Services that are allowed by the managed constraint.

spec.rules[].parameters.allowedServices[]

Optional

string

spec.rules[].parameters.defaultAWSProvider

Optional

string

Default AWS provider used when no explicit provider is specified.

spec.rules[].parameters.defaultXMLServiceProvider

Optional

string

Default XML service provider used when no explicit provider is specified.

spec.rules[].parameters.deniedEditions

Optional

list (string)

Editions that are denied by the managed constraint.

spec.rules[].parameters.deniedEditions[]

Optional

string

spec.rules[].parameters.enforcedProjects

Optional

list (string)

Projects where the managed constraint is enforced.

spec.rules[].parameters.enforcedProjects[]

Optional

string

spec.rules[].parameters.minimumDestroyScheduleDurationInDays

Optional

integer

Minimum destroy schedule duration, in days, required by the managed constraint.

spec.rules[].parameters.nonFIPSMachineTypes

Optional

list (string)

Compute Engine machine types that are not FIPS-compliant but are allowed.

spec.rules[].parameters.nonFIPSMachineTypes[]

Optional

string

spec.rules[].values

Optional

object

List of values to be used for this policy rule. This field can be set only in policies for list constraints.

spec.rules[].values.allowedValues

Optional

list (string)

List of values allowed at this resource.

spec.rules[].values.allowedValues[]

Optional

string

spec.rules[].values.deniedValues

Optional

list (string)

List of values denied at this resource.

spec.rules[].values.deniedValues[]

Optional

string

string

Status is the status of the condition. Can be True, False, Unknown.

string

Type is the type of the condition.

string

A unique specifier for the OrgPolicyPolicy resource in Google Cloud.

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.

object

ObservedState is the state of the resource as most recently observed in Google Cloud.

object

Dry-run policy. Audit-only policy, can be used to monitor how the policy would have impacted the existing and future resources if it's enforced.

string

Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.

object

Basic information about the Organization Policy.

string

Output only. The time stamp this was previously updated. This represents the last time a call to `CreatePolicy` or `UpdatePolicy` was made for that policy.