Enforce Confidential VM use

Console

1. In the Google Cloud console, go to the Organization policiespage:

   Go to Organization policies

2. Click the switcher box at the top of the page, and choose the organization to apply the constraint to. To apply the constraint to a project, select a project instead.

3. In the filter box, enter restrict non-confidential computing , and then click the Restrict Non-Confidential Computingpolicy.

4. On the Policy detailspage for Restrict Non-Confidential Computing, click edit Manage policy.

5. In the Applies tosection, click Customize.

6. In the Policy enforcementsection, choose one of the following options:

   • Merge with parent.Merge your new policy setting with that of a parent organization.

   • Replace.Replace the current policy setting and ignore that of the parent organization.

7. In the Rulessection, click Add a rule.

8. In the Policy valuesbox, select Custom, and set the Policy typeto Deny.

9. In the Custom valuesbox, enter compute.googleapis.com as the API service name you want to enforce the policy on.

10. Click Done.

11. Click Set policy.

gcloud

 gcloud  
resource-manager  
org-policies  
deny  
 \ 
  
constraints/compute.restrictNonConfidentialComputing  
compute.googleapis.com  
 \ 
  
--organization = 
 ORGANIZATION_ID 
 

Provide the following value:

• ORGANIZATION_ID : The ID of the organization to add the constraint to.

  How to find a Google Cloud organization ID

  Console

  To find a Google Cloud organization ID, complete the following steps:

  1. Go to the Google Cloud console.

     Go to the Google Cloud console

  2. Click the switcher box in the menu bar.
  3. Click the Select from box, and then select your organization.
  4. Click the All tab. The organization ID is shown next to the organization name.

  gcloud CLI

  You can retrieve a Google Cloud organization ID with the following command:

  gcloud  
  organizations  
  describe  
   ORGANIZATION_NAME 
    
  --format = 
   "value(name.segment(1))" 
  

To apply the constraint at the project level instead of the organization level, use --project= PROJECT_ID instead of --organization= ORGANIZATION_ID .

Alternatively, you can set policies with a policy file using set-policy commands .

Console

1. In the Google Cloud console, go to the Organization policiespage:

   Go to Organization policies

2. Click the switcher box at the top of the page, and choose the organization to apply the constraint to. To apply the constraint to a project, select a project instead.

3. In the filter box, enter restrict non-confidential computing , and then click the Restrict Non-Confidential Computingpolicy.

4. On the Policy detailspage for Restrict Non-Confidential Computing, click edit Manage policy.

5. Click the rule to expand it.

6. In the Policy valuesbox, select Allow all, and then click Done.

7. Click Set policy.

gcloud

 gcloud  
resource-manager  
org-policies  
delete  
 \ 
  
constraints/compute.restrictNonConfidentialComputing  
 \ 
  
--organization = 
 ORGANIZATION_ID 
 

Provide the following value:

• ORGANIZATION_ID : The ID of the organization to delete the constraint from.

  How to find a Google Cloud organization ID

  Console

  To find a Google Cloud organization ID, complete the following steps:

  1. Go to the Google Cloud console.

     Go to the Google Cloud console

  2. Click the switcher box in the menu bar.
  3. Click the Select from box, and then select your organization.
  4. Click the All tab. The organization ID is shown next to the organization name.

  gcloud CLI

  You can retrieve a Google Cloud organization ID with the following command:

  gcloud  
  organizations  
  describe  
   ORGANIZATION_NAME 
    
  --format = 
   "value(name.segment(1))" 
  

To delete the constraint at the project level instead of the organization level, use --project= PROJECT_ID instead of --organization= ORGANIZATION_ID .

Alternatively, you can set policies with a policy file using set-policy commands .