Manage Cloud Load Balancing resources using custom constraints

Google Cloud Organization Policy gives you centralized, programmatic control over your organization's resources. As the organization policy administrator , you can define an organization policy, which is a set of restrictions called constraints that apply to Google Cloud resources and descendants of those resources in the Google Cloud resource hierarchy . You can enforce organization policies at the organization, folder, or project level.

Organization Policy provides predefined constraints for various Google Cloud services. However, if you want more granular, customizable control over the specific fields that are restricted in your organization policies, you can also create custom constraints and use those custom constraints in a custom organization policy.

The following load balancing components support custom constraints:

Custom constraints are also supported by Compute Engine resources such as instance groups , and VPC resources such as VPC networks and subnets .

Benefits

Cost management : use custom organization policies to restrict the health check probe frequency.
Security, compliance, and governance : you can use custom organization policies to enforce policies. For example:
- To enforce the usage of specific health check protocols or port ranges
- To disallow certain backend traffic protocols
- To require that backend buckets have Cloud CDN enabled
- To require forwarding rules to use specific Network Service Tiers

Cloud Load Balancing supported resources

For Cloud Load Balancing, you can set custom constraints on the following resources and fields.

Backend buckets

Backend buckets : compute.googleapis.com/BackendBucket

resource.name
resource.description
resource.bucketName
resource.enableCdn
resource.cdnPolicy
- resource.cdnPolicy.bypassCacheOnRequestHeaders
  - resource.cdnPolicy.bypassCacheOnRequestHeaders.headerName
- resource.cdnPolicy.cacheKeyPolicy
  - resource.cdnPolicy.cacheKeyPolicy.includeHttpHeaders
  - resource.cdnPolicy.cacheKeyPolicy.queryStringWhitelist
  - resource.cdnPolicy.signedUrlCacheMaxAgeSec
- resource.compressionMode
- resource.customResponseHeaders

Backend services

Backend services : compute.googleapis.com/BackendService

resource.name
resource.description
resource.port
resource.portName
resource.protocol
resource.backends
- resource.backends.balancingMode
- resource.backends.capacityScaler
- resource.backends.description
- resource.backends.failover
- resource.backends.maxConnections
- resource.backends.maxConnectionsPerEndpoint
- resource.backends.maxConnectionsPerInstance
- resource.backends.maxRate
- resource.backends.maxRatePerEndpoint
- resource.backends.maxRatePerInstance
- resource.backends.maxUtilization
- resource.backends.preference
resource.enableCDN
resource.cdnPolicy
- resource.cdnPolicy.bypassCacheOnRequestHeaders
  - resource.cdnPolicy.bypassCacheOnRequestHeaders.headerName
- resource.cdnPolicy.cacheKeyPolicy
  - resource.cdnPolicy.cacheKeyPolicy.includeHost
  - resource.cdnPolicy.cacheKeyPolicy.includeHttpHeaders
  - resource.cdnPolicy.cacheKeyPolicy.includeNamedCookies
  - resource.cdnPolicy.cacheKeyPolicy.includeProtocol
  - resource.cdnPolicy.cacheKeyPolicy.includeQueryString
  - resource.cdnPolicy.cacheKeyPolicy.queryStringBlacklist
  - resource.cdnPolicy.cacheKeyPolicy.queryStringWhitelist
- resource.cdnPolicy.cacheMode
- resource.cdnPolicy.clientTtl
- resource.cdnPolicy.defaultTtl
- resource.cdnPolicy.maxTtl
- resource.cdnPolicy.negativeCaching
- resource.cdnPolicy.negativeCachingPolicy
  - resource.cdnPolicy.negativeCachingPolicy.code
  - resource.cdnPolicy.negativeCachingPolicy.ttl
- resource.cdnPolicy.requestCoalescing
- resource.cdnPolicy.serveWhileStale
- resource.cdnPolicy.signedUrlCacheMaxAgeSec
resource.circuitBreakers
- resource.circuitBreakers.maxConnections
- resource.circuitBreakers.maxPendingRequests
- resource.circuitBreakers.maxRequests
- resource.circuitBreakers.maxRequestsPerConnection
- resource.circuitBreakers.maxRetries
resource.compressionMode
resource.connectionDraining
- resource.connectionDraining.drainingTimeoutSec
resource.connectionTrackingPolicy
- resource.connectionTrackingPolicy.connectionPersistenceOnUnhealthyBackends
- resource.connectionTrackingPolicy.enableStrongAffinity
- resource.connectionTrackingPolicy.idleTimeoutSec
- resource.connectionTrackingPolicy.trackingMode
resource.consistentHash
- resource.consistentHash.httpCookie
- resource.consistentHash.httpCookie.name
- resource.consistentHash.httpCookie.path
- resource.consistentHash.httpCookie.ttl
  - resource.consistentHash.httpCookie.ttl.nanos
  - resource.consistentHash.httpCookie.ttl.seconds
- resource.consistentHash.minimumRingSize
resource.customRequestHeaders
resource.customResponseHeaders
resource.affinityCookieTtlSec
resource.failoverPolicy
- resource.failoverPolicy.disableConnectionDrainOnFailover
- resource.failoverPolicy.dropTrafficIfUnhealthy
- resource.failoverPolicy.failoverRatio
resource.iap
- resource.iap.enabled
- resource.iap.oauth2ClientId
resource.ipAddressSelectionPolicy
resource.loadBalancingScheme
resource.localityLbPolicies
- resource.localityLbPolicies.customPolicy
- resource.localityLbPolicies.customPolicy.data
- resource.localityLbPolicies.customPolicy.name
- resource.localityLbPolicies.policy
- resource.localityLbPolicies.policy.name
resource.logConfig
- resource.logConfig.enable
- resource.logConfig.optionalFields
- resource.logConfig.optionalMode
- resource.logConfig.sampleRate
resource.maxStreamDuration
- resource.maxStreamDuration.nanos
- resource.maxStreamDuration.seconds
resource.outlierDetection
- resource.outlierDetection.baseEjectionTime
- resource.outlierDetection.baseEjectionTime.nanos
- resource.outlierDetection.baseEjectionTime.seconds
- resource.outlierDetection.consecutiveGatewayFailure
- resource.outlierDetection.enforcingConsecutiveErrors
- resource.outlierDetection.enforcingConsecutiveGatewayFailure
- resource.outlierDetection.enforcingSuccessRate
- resource.outlierDetection.maxEjectionPercent
- resource.outlierDetection.successRateMinimumHosts
- resource.outlierDetection.successRateRequestVolume
- resource.outlierDetection.successRateStdevFactor
resource.securitySettings
- resource.securitySettings.awsV4Authentication
- resource.securitySettings.awsV4Authentication.accessKeyId
- resource.securitySettings.awsV4Authentication.accessKeyVersion
- resource.securitySettings.subjectAltNames
resource.sessionAffinity
resource.subsetting
- resource.subsetting.policy
resource.timeoutSec
resource.strongSessionAffinityCookie
- resource.strongSessionAffinityCookie.name
- resource.strongSessionAffinityCookie.path
- resource.strongSessionAffinityCookie.ttl
- resource.strongSessionAffinityCookie.ttl.nanos
- resource.strongSessionAffinityCookie.ttl.seconds

Forwarding rules

Forwarding rules : compute.googleapis.com/ForwardingRule

resource.name
resource.description
resource.allowGlobalAccess
resource.allowPscGlobalAccess
resource.allPorts
resource.IPProtocol
resource.ipVersion
resource.isMirroringCollector
resource.loadBalancingScheme
resource.metadataFilters
- resource.metadataFilters.filterLabels
- resource.metadataFilters.filterLabels.name
- resource.metadataFilters.filterLabels.value
- resource.metadataFilters.filterMatchCriteria
resource.networkTier
resource.noAutomateDnsZone
resource.portRange
resource.ports
resource.serviceDirectoryRegistrations
- resource.serviceDirectoryRegistrations.namespace
- resource.serviceDirectoryRegistrations.service
- resource.serviceDirectoryRegistrations.serviceDirectoryRegion
resource.serviceLabel
resource.sourceIpRanges

Health checks

Health check : compute.googleapis.com/HealthCheck

resource.name
resource.description
resource.checkIntervalSec
resource.timeoutSec
resource.unhealthyThreshold
resource.healthyThreshold
resource.type
TCP health check:
- resource.tcpHealthCheck.port
- resource.tcpHealthCheck.request
- resource.tcpHealthCheck.response
- resource.tcpHealthCheck.proxyHeader
- resource.tcpHealthCheck.portSpecification
SSL health check:
- resource.sslHealthCheck.port
- resource.sslHealthCheck.request
- resource.sslHealthCheck.response
- resource.sslHealthCheck.proxyHeader
- resource.sslHealthCheck.portSpecification
HTTP health check:
- resource.httpHealthCheck.port
- resource.httpHealthCheck.host
- resource.httpHealthCheck.requestPath
- resource.httpHealthCheck.proxyHeader
- resource.httpHealthCheck.response
- resource.httpHealthCheck.portSpecification
HTTPS health check:
- resource.httpsHealthCheck.port
- resource.httpsHealthCheck.host
- resource.httpsHealthCheck.requestPath
- resource.httpsHealthCheck.proxyHeader
- resource.httpsHealthCheck.response
- resource.httpsHealthCheck.portSpecification
HTTP/2 health check:
- resource.http2HealthCheck.port
- resource.http2HealthCheck.host
- resource.http2HealthCheck.requestPath
- resource.http2HealthCheck.proxyHeader
- resource.http2HealthCheck.response
- resource.http2HealthCheck.portSpecification
gRPC health check:
- resource.grpcHealthCheck.port
- resource.grpcHealthCheck.grpcServiceName
- resource.grpcHealthCheck.portSpecification
resource.sourceRegions
resource.logConfig
- resource.logConfig.enable

Network endpoint groups

Network endpoint groups : compute.googleapis.com/NetworkEndpointGroup

resource.annotations
resource.appEngine.service
resource.appEngine.urlMask
resource.appEngine.version
resource.cloudFunction.function
resource.cloudFunction.urlMask
resource.cloudRun.service
resource.cloudRun.tag
resource.cloudRun.urlMask
resource.defaultPort
resource.description
resource.name
resource.network
resource.networkEndpointType
resource.pscData.producerPort
resource.pscTargetService
resource.subnetwork

Service load balancing policy

Service load balancing policy : networkservices.googleapis.com/ServiceLbPolicy

resource.autoCapacityDrain.enable
resource.description
resource.failoverConfig.failoverHealthThreshold
resource.loadBalancingAlgorithm
resource.name

SSL policies

SSL policies : compute.googleapis.com/SslPolicy

resource.profile
resource.name
resource.description
resource.minTlsVersion
resource.customFeatures

Target instances

Target instances : compute.googleapis.com/TargetInstance

resource.name
resource.description
resource.natPolicy

Target pools

Target pools : compute.googleapis.com/TargetPool

resource.name
resource.description
resource.sessionAffinity
resource.failoverRatio

Target proxies

Target TCP proxies : compute.googleapis.com/TargetTcpProxy

resource.name
resource.description
resource.proxyBind
resource.proxyHeader

Target SSL proxies : compute.googleapis.com/TargetSslProxy

resource.name
resource.description
resource.proxyHeader

Target HTTP proxies : compute.googleapis.com/TargetHttpProxy

resource.name
resource.description
resource.proxyBind
resource.httpKeepAliveTimeoutSec

Target HTTPS proxies : compute.googleapis.com/TargetHttpsProxy

resource.name
resource.description
resource.proxyBind
resource.httpKeepAliveTimeoutSec
resource.quicOverride
resource.tlsEarlyData

Target gRPC proxies : compute.googleapis.com/TargetGrpcProxy

resource.name
resource.description
resource.validateForProxyless

URL maps

URL maps : compute.googleapis.com/UrlMap

resource.name
resource.description
resource.defaultCustomErrorResponsePolicy
- resource.defaultCustomErrorResponsePolicy.errorResponseRules
  - resource.defaultCustomErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.defaultCustomErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.defaultCustomErrorResponsePolicy.errorResponseRules.path
resource.defaultRouteAction
- resource.defaultRouteAction.corsPolicy
- resource.defaultRouteAction.corsPolicy.allowCredentials
- resource.defaultRouteAction.corsPolicy.allowHeaders
- resource.defaultRouteAction.corsPolicy.allowMethods
- resource.defaultRouteAction.corsPolicy.allowOrigins
- resource.defaultRouteAction.corsPolicy.allowOriginRegexes
- resource.defaultRouteAction.corsPolicy.disabled
- resource.defaultRouteAction.corsPolicy.exposeHeaders
- resource.defaultRouteAction.corsPolicy.maxAge
- resource.defaultRouteAction.faultInjectionPolicy
- resource.defaultRouteAction.faultInjectionPolicy.abort
  - resource.defaultRouteAction.faultInjectionPolicy.abort.httpStatus
  - resource.defaultRouteAction.faultInjectionPolicy.abort.percentage
- resource.defaultRouteAction.faultInjectionPolicy.delay
  - resource.defaultRouteAction.faultInjectionPolicy.delay.percentage
  - resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay
  - resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.nanos
  - resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.seconds
- resource.defaultRouteAction.maxStreamDuration
- resource.defaultRouteAction.maxStreamDuration.nanos
- resource.defaultRouteAction.maxStreamDuration.seconds
- resource.defaultRouteAction.requestMirrorPolicy
- resource.defaultRouteAction.retryPolicy
- resource.defaultRouteAction.retryPolicy.numRetries
- resource.defaultRouteAction.retryPolicy.perTryTimeout
  - resource.defaultRouteAction.retryPolicy.perTryTimeout.nanos
  - resource.defaultRouteAction.retryPolicy.perTryTimeout.seconds
- resource.defaultRouteAction.retryPolicy.retryConditions
- resource.defaultRouteAction.timeout
- resource.defaultRouteAction.timeout.nanos
- resource.defaultRouteAction.timeout.seconds
- resource.defaultRouteAction.urlRewrite
- resource.defaultRouteAction.urlRewrite.hostRewrite
- resource.defaultRouteAction.urlRewrite.pathPrefixRewrite
- resource.defaultRouteAction.urlRewrite.pathTemplateRewrite
- resource.defaultRouteAction.weightedBackendServices
- resource.defaultRouteAction.weightedBackendServices.headerAction
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToRemove
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToRemove
- resource.defaultRouteAction.weightedBackendServices.weight
resource.defaultUrlRedirect
- resource.defaultUrlRedirect.hostRedirect
- resource.defaultUrlRedirect.httpsRedirect
- resource.defaultUrlRedirect.pathRedirect
- resource.defaultUrlRedirect.prefixRedirect
- resource.defaultUrlRedirect.redirectResponseCode
- resource.defaultUrlRedirect.stripQuery
resource.headerAction
- resource.headerAction.requestHeadersToAdd
- resource.headerAction.requestHeadersToAdd.headerName
- resource.headerAction.requestHeadersToAdd.headerValue
- resource.headerAction.requestHeadersToAdd.replace
- resource.headerAction.requestHeadersToRemove
- resource.headerAction.responseHeadersToAdd
- resource.headerAction.responseHeadersToAdd.headerName
- resource.headerAction.responseHeadersToAdd.headerValue
- resource.headerAction.responseHeadersToAdd.replace
- resource.headerAction.responseHeadersToRemove
resource.hostRules
- resource.hostRules.description
- resource.hostRules.hosts
- resource.hostRules.pathMatcher
resource.pathMatchers
- resource.pathMatchers.name
- resource.pathMatchers.description
- resource.pathMatchers.defaultCustomErrorResponsePolicy
- resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules
  - resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.path
- resource.pathMatchers.defaultRouteAction
- resource.pathMatchers.defaultRouteAction.corsPolicy
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowCredentials
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowHeaders
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowMethods
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowOrigins
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowOriginRegexes
  - resource.pathMatchers.defaultRouteAction.corsPolicy.disabled
  - resource.pathMatchers.defaultRouteAction.corsPolicy.exposeHeaders
  - resource.pathMatchers.defaultRouteAction.corsPolicy.maxAge
- resource.pathMatchers.defaultRouteAction.faultInjectionPolicy
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort.httpStatus
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort.percentage
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.percentage
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay
    - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.nanos
    - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.seconds
- resource.pathMatchers.defaultRouteAction.maxStreamDuration
  - resource.pathMatchers.defaultRouteAction.maxStreamDuration.nanos
  - resource.pathMatchers.defaultRouteAction.maxStreamDuration.seconds
- resource.pathMatchers.defaultRouteAction.requestMirrorPolicy
- resource.pathMatchers.defaultRouteAction.retryPolicy
  - resource.pathMatchers.defaultRouteAction.retryPolicy.numRetries
  - resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout
  - resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout.nanos
  - resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout.seconds
  - resource.pathMatchers.defaultRouteAction.retryPolicy.retryConditions
- resource.pathMatchers.defaultRouteAction.timeout
  - resource.pathMatchers.defaultRouteAction.timeout.nanos
  - resource.pathMatchers.defaultRouteAction.timeout.seconds
- resource.pathMatchers.defaultRouteAction.urlRewrite
  - resource.pathMatchers.defaultRouteAction.urlRewrite.hostRewrite
  - resource.pathMatchers.defaultRouteAction.urlRewrite.pathPrefixRewrite
  - resource.pathMatchers.defaultRouteAction.urlRewrite.pathTemplateRewrite
- resource.pathMatchers.defaultRouteAction.weightedBackendServices
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToRemove
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToRemove
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.weight
- resource.pathMatchers.defaultUrlRedirect
- resource.pathMatchers.defaultUrlRedirect.hostRedirect
- resource.pathMatchers.defaultUrlRedirect.httpsRedirect
- resource.pathMatchers.defaultUrlRedirect.pathRedirect
- resource.pathMatchers.defaultUrlRedirect.prefixRedirect
- resource.pathMatchers.defaultUrlRedirect.redirectResponseCode
- resource.pathMatchers.defaultUrlRedirect.stripQuery
- resource.pathMatchers.headerAction
- resource.pathMatchers.headerAction.requestHeadersToAdd
- resource.pathMatchers.headerAction.requestHeadersToAdd.headerName
- resource.pathMatchers.headerAction.requestHeadersToAdd.headerValue
- resource.pathMatchers.headerAction.requestHeadersToAdd.replace
- resource.pathMatchers.headerAction.requestHeadersToRemove
- resource.pathMatchers.headerAction.responseHeadersToAdd
- resource.pathMatchers.headerAction.responseHeadersToAdd.headerName
- resource.pathMatchers.headerAction.responseHeadersToAdd.headerValue
- resource.pathMatchers.headerAction.responseHeadersToAdd.replace
- resource.pathMatchers.headerAction.responseHeadersToRemove
- resource.pathMatchers.pathRules
- resource.pathMatchers.pathRules.paths
- resource.pathMatchers.pathRules.customErrorResponsePolicy
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.path
- resource.pathMatchers.pathRules.routeAction
  - resource.pathMatchers.pathRules.routeAction.corsPolicy
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowCredentials
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowHeaders
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowMethods
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowOrigins
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowOriginRegexes
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.disabled
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.exposeHeaders
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.maxAge
  - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy
  - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort.httpStatus
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort.percentage
  - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.percentage
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay.nanos
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay.seconds
  - resource.pathMatchers.pathRules.routeAction.maxStreamDuration
  - resource.pathMatchers.pathRules.routeAction.maxStreamDuration.nanos
  - resource.pathMatchers.pathRules.routeAction.maxStreamDuration.seconds
  - resource.pathMatchers.pathRules.routeAction.requestMirrorPolicy
  - resource.pathMatchers.pathRules.routeAction.retryPolicy
  - resource.pathMatchers.pathRules.routeAction.retryPolicy.numRetries
  - resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout
    - resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout.nanos
    - resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout.seconds
  - resource.pathMatchers.pathRules.routeAction.retryPolicy.retryConditions
  - resource.pathMatchers.pathRules.routeAction.timeout
  - resource.pathMatchers.pathRules.routeAction.timeout.nanos
  - resource.pathMatchers.pathRules.routeAction.timeout.seconds
  - resource.pathMatchers.pathRules.routeAction.urlRewrite
  - resource.pathMatchers.pathRules.routeAction.urlRewrite.hostRewrite
  - resource.pathMatchers.pathRules.routeAction.urlRewrite.pathPrefixRewrite
  - resource.pathMatchers.pathRules.routeAction.urlRewrite.pathTemplateRewrite
  - resource.pathMatchers.pathRules.routeAction.weightedBackendServices
  - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToRemove
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToRemove
  - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.weight
- resource.pathMatchers.pathRules.urlRedirect
  - resource.pathMatchers.pathRules.urlRedirect.hostRedirect
  - resource.pathMatchers.pathRules.urlRedirect.httpsRedirect
  - resource.pathMatchers.pathRules.urlRedirect.pathRedirect
  - resource.pathMatchers.pathRules.urlRedirect.prefixRedirect
  - resource.pathMatchers.pathRules.urlRedirect.redirectResponseCode
  - resource.pathMatchers.pathRules.urlRedirect.stripQuery
- resource.pathMatchers.routeRules
- resource.pathMatchers.routeRules.description
- resource.pathMatchers.routeRules.priority
- resource.pathMatchers.routeRules.customErrorResponsePolicy
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.path
- resource.pathMatchers.routeRules.headerAction
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.headerName
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.headerValue
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.replace
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToRemove
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.headerName
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.headerValue
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.replace
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToRemove
- resource.pathMatchers.routeRules.matchRules
  - resource.pathMatchers.routeRules.matchRules.fullPathMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches
  - resource.pathMatchers.routeRules.matchRules.headerMatches.exactMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.headerName
  - resource.pathMatchers.routeRules.matchRules.headerMatches.invertMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.prefixMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.presentMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch
    - resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch.rangeStart
    - resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch.rangeEnd
  - resource.pathMatchers.routeRules.matchRules.headerMatches.regexMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.suffixMatch
  - resource.pathMatchers.routeRules.matchRules.ignoreCase
  - resource.pathMatchers.routeRules.matchRules.metadataFilters
  - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels
    - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels.name
    - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels.value
  - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterMatchCriteria
  - resource.pathMatchers.routeRules.matchRules.pathTemplateMatch
  - resource.pathMatchers.routeRules.matchRules.prefixMatch
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.name
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.exactMatch
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.presentMatch
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.regexMatch
  - resource.pathMatchers.routeRules.matchRules.regexMatch
- resource.pathMatchers.routeRules.routeAction
  - resource.pathMatchers.routeRules.routeAction.corsPolicy
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowCredentials
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowHeaders
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowMethods
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowOrigins
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowOriginRegexes
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.disabled
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.exposeHeaders
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.maxAge
  - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy
  - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort.httpStatus
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort.percentage
  - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.percentage
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay.nanos
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay.seconds
  - resource.pathMatchers.routeRules.routeAction.maxStreamDuration
  - resource.pathMatchers.routeRules.routeAction.maxStreamDuration.nanos
  - resource.pathMatchers.routeRules.routeAction.maxStreamDuration.seconds
  - resource.pathMatchers.routeRules.routeAction.requestMirrorPolicy
  - resource.pathMatchers.routeRules.routeAction.retryPolicy
  - resource.pathMatchers.routeRules.routeAction.retryPolicy.numRetries
  - resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout
    - resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout.nanos
    - resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout.seconds
  - resource.pathMatchers.routeRules.routeAction.retryPolicy.retryConditions
  - resource.pathMatchers.routeRules.routeAction.timeout
  - resource.pathMatchers.routeRules.routeAction.timeout.nanos
  - resource.pathMatchers.routeRules.routeAction.timeout.seconds
  - resource.pathMatchers.routeRules.routeAction.urlRewrite
  - resource.pathMatchers.routeRules.routeAction.urlRewrite.hostRewrite
  - resource.pathMatchers.routeRules.routeAction.urlRewrite.pathPrefixRewrite
  - resource.pathMatchers.routeRules.routeAction.urlRewrite.pathTemplateRewrite
  - resource.pathMatchers.routeRules.routeAction.weightedBackendServices
  - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToRemove
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToRemove
  - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.weight
- resource.pathMatchers.routeRules.urlRedirect
  - resource.pathMatchers.routeRules.urlRedirect.hostRedirect
  - resource.pathMatchers.routeRules.urlRedirect.httpsRedirect
  - resource.pathMatchers.routeRules.urlRedirect.pathRedirect
  - resource.pathMatchers.routeRules.urlRedirect.prefixRedirect
  - resource.pathMatchers.routeRules.urlRedirect.redirectResponseCode
  - resource.pathMatchers.routeRules.urlRedirect.stripQuery
resource.tests
- resource.tests.description
- resource.tests.expectedOutputUrl
- resource.tests.expectedRedirectResponseCode
- resource.tests.headers
- resource.tests.headers.name
- resource.tests.headers.value
- resource.tests.host
- resource.tests.path

For other supported compute resources, see the Compute Engine custom constraints page for details.

Policy inheritance

By default, organization policies are inherited by the descendants of the resources on which you enforce the policy. For example, if you enforce a policy on a folder, Google Cloud enforces the policy on all projects in the folder. To learn more about this behavior and how to change it, refer to Hierarchy evaluation rules .

Before you begin

If you haven't already, set up authentication . Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:
Select the tab for how you plan to use the samples on this page:
Console

When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.
gcloud
1. Install the Google Cloud CLI. After installation, initialize the Google Cloud CLI by running the following command:
  gcloud init
  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity .
  
  Note:If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update .
2. Set a default region and zone .

Ensure that you know your organization ID .

Required roles

To get the permissions that you need to manage organization policies for Cloud Load Balancing resources, ask your administrator to grant you the following IAM roles:

Organization policy administrator ( roles/orgpolicy.policyAdmin ) on the organization resource_types
To test the constraints on load balancing resources: Compute Load Balancer Admin (v1) ( roles/compute.loadBalancerAdmin.v1 ) on the project resource

For more information about granting roles, see Manage access to projects, folders, and organizations .

These predefined roles contain the permissions required to manage organization policies for Cloud Load Balancing resources. To see the exact permissions that are required, expand the Required permissionssection:

Required permissions

The following permissions are required to manage organization policies for Cloud Load Balancing resources:

orgpolicy.constraints.list
orgpolicy.policies.create
orgpolicy.policies.delete
orgpolicy.policies.list
orgpolicy.policies.update
orgpolicy.policy.get
orgpolicy.policy.set

You might also be able to get these permissions with custom roles or other predefined roles .

Set up a custom constraint

A custom constraint is defined by the resources, methods, conditions, and actions that are supported by the service on which you are enforcing the organization policy. Conditions for your custom constraints are defined using Common Expression Language (CEL) . For more information about how to build conditions in custom constraints using CEL, see the CEL section of Creating and managing custom organization policies .

You can create a custom constraint and set it up for use in organization policies using the Google Cloud console or gcloud CLI.

Console

In the Google Cloud console, go to the Organization policiespage.

Go to Organization policies
Select the project picker at the top of the page.
From the Select a resourcewindow, select the organization for which you want to create a custom constraint.
Click Custom constraint.
In the Display namebox, enter a human-friendly name for the constraint. This field has a maximum length of 200 characters. Don't use PII or sensitive data in constraint names, because they could be exposed in error messages.
In the Constraint IDbox, enter the name you want for your new custom constraint. A custom constraint must start with custom. , and can only include uppercase letters, lowercase letters, or numbers, for example, custom.enforceTCPHealthCheckPort1024 . The maximum length of this field is 70 characters, not counting the prefix, for example, organizations/123456789/customConstraints/custom. .
In the Descriptionbox, enter a human-friendly description of the constraint to display as an error message when the policy is violated. This field has a maximum length of 2000 characters.
In the Resource typebox, select the name of the Google Cloud REST resource containing the object and field you want to restrict. For example, compute.googleapis.com/HealthCheck .
Under Enforcement method, select whether to enforce the constraint on the REST CREATE method.
To define a condition, click Edit condition.
1. In the Add conditionpanel, create a CEL condition that refers to a supported service resource, for example resource.tcpHealthCheck.port >= 1024 . This field has a maximum length of 1000 characters.
2. Click Save.
Under Action, select whether to allow or deny the evaluated method if the previous condition is met.
Click Create constraint.

When you have entered a value into each field, the equivalent YAML configuration for this custom constraint appears on the right.

gcloud

To create a custom constraint using the gcloud CLI, create a YAML file for the custom constraint:

  name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/ CONSTRAINT_NAME 
 
 resource_types 
 : 
 - 
  
 compute.googleapis.com/ RESOURCE_NAME 
 
 method_types 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
  CONDITION 
 
 action_type 
 : 
  
  ACTION 
 
 display_name 
 : 
  
  DISPLAY_NAME 
 
 description 
 : 
  
  DESCRIPTION

Replace the following:

ORGANIZATION_ID : your organization ID, such as 123456789 .
CONSTRAINT_NAME : the name you want for your new custom constraint. A custom constraint must start with custom. , and can only include uppercase letters, lowercase letters, or numbers. For example, custom.enforceTCPHealthCheckPort1024 . The maximum length of this field is 70 characters, not counting the prefix (for example, organizations/123456789/customConstraints/custom. ).
RESOURCE_NAME : the name (not the URI) of the Compute Engine API REST resource containing the object and field you want to restrict. For example, HealthCheck .
CONDITION : a CEL condition that is written against a representation of a supported service resource. This field has a maximum length of 1000 characters. See Supported resources for more information about the resources available to write conditions against. For example, "resource.tcpHealthCheck.port >= 1024" .
ACTION : the action to take if the condition is met. This can be either ALLOW or DENY .
DISPLAY_NAME : a human-friendly name for the constraint. This field has a maximum length of 200 characters.
DESCRIPTION : a human-friendly description of the constraint to display as an error message when the policy is violated. This field has a maximum length of 2000 characters.

For more information about how to create a custom constraint, see Creating and managing custom organization policies .

After you have created the YAML file for a new custom constraint, you must set it up to make it available for organization policies in your organization. To set up a custom constraint, use the gcloud org-policies set-custom-constraint command:

gcloud  
org-policies  
set-custom-constraint  
 CONSTRAINT_PATH

Replace

 CONSTRAINT_PATH

with the full path to your custom constraint file. For example, /home/user/customconstraint.yaml . Once completed, your custom constraints are available as organization policies in your list of Google Cloud organization policies. To verify that the custom constraint exists, use the gcloud org-policies list-custom-constraints command:

gcloud  
org-policies  
list-custom-constraints  
--organization = 
 ORGANIZATION_ID

Replace

 ORGANIZATION_ID

with the ID of your organization resource. For more information, see Viewing organization policies .

Enforce a custom constraint

You can enforce a constraint by creating an organization policy that references it, and then applying that organization policy to a Google Cloud resource.

Console

In the Google Cloud console, go to the Organization policies page.
Go to Organization policies
From the project picker, select the project for which you want to set the organization policy.
From the list on the Organization policies page, select your constraint to view the Policy details page for that constraint.
To configure the organization policy for this resource, click Manage policy .
On the Edit policy page, select Override parent's policy .
Click Add a rule .
In the Enforcement section, select whether enforcement of this organization policy is on or off.
Optional: To make the organization policy conditional on a tag, click Add condition . Note that if you add a conditional rule to an organization policy, you must add at least one unconditional rule or the policy cannot be saved. For more information, see Setting an organization policy with tags .
Click Test changes to simulate the effect of the organization policy. Policy simulation isn't available for legacy managed constraints. For more information, see Test organization policy changes with Policy Simulator .
To finish and apply the organization policy, click Set policy . The policy requires up to 15 minutes to take effect.

gcloud

To create an organization policy with boolean rules, create a policy YAML file that references the constraint:

  
 name 
 : 
  
 projects/ PROJECT_ID 
/policies/ CONSTRAINT_NAME 
 
  
 spec 
 : 
  
 rules 
 : 
  
 - 
  
 enforce 
 : 
  
 true

Replace the following:

PROJECT_ID : the project on which you want to enforce your constraint.
CONSTRAINT_NAME : the name you defined for your custom constraint. For example, custom.enforceTCPHealthCheckPort1024 .

To enforce the organization policy containing the constraint, run the following command:

  
gcloud  
org-policies  
set-policy  
 POLICY_PATH

Replace POLICY_PATH with the full path to your organization policy YAML file. The policy requires up to 15 minutes to take effect.

Example: Use custom constraints to restrict TLS capabilities

To restrict TLS capabilities for supported load balancers using custom constraints, define a policy that uses the predefined constraints/compute.requireSslPolicy constraint in your organization. After defining the policy, follow these steps to set up the custom constraints and use them.

Create a YAML file for the predefined constraint.

  name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom. CONSTRAINT_NAME 
 
 resource_types 
 : 
  
 compute.googleapis.com/SslPolicy 
 methodTypes 
 : 
 - 
  
  CREATE 
 
 - 
  
  UPDATE 
 
 condition 
 : 
  
 resource. FIELD_NAME 
== VALUE 
 
 action_type 
 : 
  
  ACTION 
 
 display_name 
 : 
  
  DISPLAY_NAME 
 
 description 
 : 
  
  DESCRIPTION

The following example restricts the minimum TLS version to 1.2:

  name 
 : 
  
 organizations/012345678901/customConstraints/custom.restrictLbTlsVersion 
 resource_types 
 : 
  
 compute.googleapis.com/SslPolicy 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 resource.minTlsVersion == "TLS_1_2" 
 action_type 
 : 
  
 ALLOW 
 display_name 
 : 
  
 Restrict Load Balancing TLS version to 1.2 
 description 
 : 
  
 Only allow SSL policies to be created or updated if the minimum TLS version is 1.2 where this custom constraint is enforced.

The following is another example of a custom constraint that only allows the creation of an SSL resource if the following conditions are met:

The minimum TLS version is set to 1.2.
The SSL policy has a CUSTOMprofile that lets you select SSL features individually.
The SSL policy does not include the ChaCha20-Poly1305 cipher suite.

  name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.restrictLbTlsCapabilities 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/SslPolicy 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 resource.minTlsVersion == "TLS_1_2" && resource.profile == 
 "CUSTOM" 
 && 
 !resource.customFeatures.exists(feature, 
  
 feature.contains("CHACHA20_POLY1305")) 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Restrict Load Balancing TLS Capabilities 
 description 
 : 
  
 Only allow SSL Policy resources to be created or updated if the minimum TLS version is 1.2, profile is CUSTOM, and no ChaCha20-Poly1305 cipher suite is used where this custom constraint is enforced.

Add the custom constraint to your organization.

gcloud org-policies set-custom-constraint PATH_TO_FILE

Verify that the custom constraint exists in your organization.

gcloud org-policies list-custom-constraints \
    --organization= ORGANIZATION_ID

Create a policy file for the constraint.

 name 
 : 
  
 projects/ PROJECT_ID 
/policies/custom. CONSTRAINT_NAME 
 
 spec 
 : 
  
 rules 
 : 
 – 
 enforce 
 : 
  
 true

Replace the following:

PROJECT_ID : your Google Cloud project ID
CONSTRAINT_NAME : the constraint name

Enforce the policy.
```
gcloud org-policies set-policy PATH_TO_POLICY_FILE 
```
Replace PATH_TO_POLICY_FILE with the fully qualified path to your policy file.

Assuming you have created the YAML file to restrict the minimum TLS version to 1.2, test the constraint by creating an SSL policy with minTlsVersion set to TLS_1_0 :

gcloud compute ssl-policies create SSL_POLICY_NAME 
\
    --min-tls-version=1.0 \
    --project= PROJECT_ID

The output is similar to the following:

ERROR: (gcloud.compute.ssl-policies.update) HTTPError 412: Operation
denied by custom org policy: [customConstraints/custom.
restrictLbTlsVersion] : Only allow SSL policy resources to be created or
updated if the minimum TLS version is 1.2 where this custom constraint
is enforced.

Example: Create a constraint that restricts TCP health check port to minimum 1024

The following example creates a custom constraint and policy that restricts the TCP health check port number to a minimum of 1024 .

Before you begin, you need to know the following:

Your organization ID
A project ID

gcloud

Create a enforceTCPHealthCheckPort1024.yaml constraint file with the following information:

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.enforceTCPHealthCheckPort1024 
 resource_types 
 : 
–  
 compute.googleapis.com/HealthCheck 
 condition 
 : 
  
 "resource.tcpHealthCheck.port 
  
 >= 
  
 1024" 
 method_types 
 : 
–  
 CREATE 
–  
 UPDATE 
 action_type 
 : 
  
 ALLOW 
 display_name 
 : 
  
 Only TCP HealthCheck Port >= 1024 Allowed. 
 description 
 : 
  
 Prevent TCP health checks on well-known ports.

Set the custom constraint.

gcloud org-policies set-custom-constraint enforceTCPHealthCheckPort1024.yaml

Create a enforceTCPHealthCheckPort1024-policy.yaml policy file with the following information. In this example we enforce this constraint at the project level but you might also set this at the organization or folder level. Replace PROJECT_ID with your project ID.
```
 name 
 : 
  
 projects/ PROJECT_ID 
/policies/custom.enforceTCPHealthCheckPort1024 
 spec 
 : 
  
 rules 
 : 
 – 
 enforce 
 : 
  
 true 
```

Enforce the policy.

gcloud org-policies set-policy enforceTCPHealthCheckPort1024-policy.yaml

Test the constraint by trying to create TCP health check on port 80, which is disallowed.

gcloud compute health-checks create tcp my-tcp-health-check \
    --project= PROJECT_ID 
\
    --region=us-central1 \
    --port=80 \
    --check-interval=5s \
    --timeout=5s \
    --healthy-threshold=4 \
    --unhealthy-threshold=5 \

The output is similar to the following:

ERROR: (gcloud.compute.healthChecks.create) Could not fetch resource:
– Operation denied by custom org policies: [customConstraints/ custom.enforceTCPHealthCheckPort1024 
]: Only TCP HealthCheck Port >= 1024 Allowed.

More examples for common use cases

The following sections provide the syntax for some custom constraints that you might find useful:

Backend buckets

Use case	Syntax
Require all backend buckets to have Cloud CDN enabled	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.backendBucketEnableCdn resourceTypes : - compute.googleapis.com/BackendBucket methodTypes : - CREATE - UPDATE condition : "resource.enableCdn == true" actionType : ALLOW displayName : Require all backend buckets to have Cloud CDN enabled description : All backend buckets must have Cloud CDN enabled.

Use case

Syntax

Require all backend buckets to have Cloud CDN enabled

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.backendBucketEnableCdn 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/BackendBucket 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.enableCdn 
  
 == 
  
 true" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Require all backend buckets to have Cloud CDN enabled 
 description 
 : 
  
 All backend buckets must have Cloud CDN enabled.

Backend services

Use case	Syntax
Disallow the use of HTTP and TCP as backend service protocols	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.backendBucketEnableCdn resourceTypes : - compute.googleapis.com/BackendService methodTypes : - CREATE - UPDATE condition : "resource.serviceProtocol == 'HTTP' \|\| resource.serviceProtocol == 'TCP'" actionType : DENY displayName : Disallow the use of HTTP and TCP as backend service protocols description : Backend services cannot configure HTTP or TCP as the backend service protocol.

Use case

Syntax

Disallow the use of HTTP and TCP as backend service protocols

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.backendBucketEnableCdn 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/BackendService 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.serviceProtocol 
  
 == 
  
 'HTTP' 
  
 || 
  
 resource.serviceProtocol 
  
 == 
  
 'TCP'" 
 actionType 
 : 
  
 DENY 
 displayName 
 : 
  
 Disallow the use of HTTP and TCP as backend service protocols 
 description 
 : 
  
 Backend services cannot configure HTTP or TCP as the backend service protocol.

Forwarding rules

Use case	Syntax
Require forwarding rules to use Standard Tier	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.forwardingRulesStandardTier resourceTypes : - compute.googleapis.com/ForwardingRule methodTypes : - CREATE - UPDATE condition : "resource.networkTier == 'STANDARD'" actionType : ALLOW displayName : Require forwarding rules to use Standard Tier description : Forwarding rules must use the Standard Network Service Tier.

Use case

Syntax

Require forwarding rules to use Standard Tier

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.forwardingRulesStandardTier 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/ForwardingRule 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.networkTier 
  
 == 
  
 'STANDARD'" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Require forwarding rules to use Standard Tier 
 description 
 : 
  
 Forwarding rules must use the Standard Network Service Tier.

Health checks

Use case	Syntax
Require all health check protocols to occur on port 1024 or higher	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.healthCheckPortMin1024 resourceTypes : - compute.googleapis.com/HealthCheck methodTypes : - CREATE - UPDATE condition : "resource.tcpHealthCheck.port >= 1024 && resource.httpHealthCheck.port >= 1024 && resource.httpsHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 &&resource.http2HealthCheck.port >= 1024 && resource.grpcHealthCheck.port >= 1024" actionType : ALLOW displayName : Require port 1024 or greater for all health checks description : All health check protocols must use a port of 1024 or higher, to avoid well-known ports.
Disallow GRPC health checks	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.disallowGRPCHealthChecks resourceTypes : - compute.googleapis.com/HealthCheck methodTypes : - CREATE - UPDATE condition : "resource.type == 'GRPC'" actionType : DENY displayName : Disallow GRPC health checks description : Health checks aren't allowed to use GRPC.
Prevent high frequency health check probes	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.minHealthCheckFrequency resourceTypes : - compute.googleapis.com/HealthCheck methodTypes : - CREATE - UPDATE condition : "resource.checkIntervalSec >= 30" actionType : ALLOW displayName : Disallow fast health check probes description : Prevent health checks from having a probe frequency under 30 seconds.

Use case

Syntax

Require all health check protocols to occur on port 1024 or higher

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.healthCheckPortMin1024 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/HealthCheck 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.tcpHealthCheck.port 
  
 >= 
  
 1024 
  
 && 
  
 resource.httpHealthCheck.port 
  
 >= 
  
 1024 
  
 && 
  
 resource.httpsHealthCheck.port 
  
 >= 
  
 1024 
  
 && 
  
 resource.sslHealthCheck.port 
  
 >= 
  
 1024 
  
 && 
  
 resource.sslHealthCheck.port 
  
 >= 
  
 1024 
  
 &&resource.http2HealthCheck.port 
  
 >= 
  
 1024 
  
 && 
  
 resource.grpcHealthCheck.port 
  
 >= 
  
 1024" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Require port 1024 or greater for all health checks 
 description 
 : 
  
 All health check protocols must use a port of 1024 or higher, to avoid well-known ports.

Disallow GRPC health checks

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.disallowGRPCHealthChecks 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/HealthCheck 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.type 
  
 == 
  
 'GRPC'" 
 actionType 
 : 
  
 DENY 
 displayName 
 : 
  
 Disallow GRPC health checks 
 description 
 : 
  
 Health checks aren't allowed to use GRPC.

Prevent high frequency health check probes

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.minHealthCheckFrequency 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/HealthCheck 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.checkIntervalSec 
  
 >= 
  
 30" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Disallow fast health check probes 
 description 
 : 
  
 Prevent health checks from having a probe frequency under 30 seconds.

Target proxies

Use case	Syntax
Disallow client HTTPS keepalive timeout values greater than 1000 seconds	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.clientHTTPSKeepalive1000Sec resourceTypes : - compute.googleapis.com/TargetHttpsProxy methodTypes : - CREATE - UPDATE condition : "resource.httpKeepAliveTimeoutSec > 1000" actionType : DENY displayName : Disallow client HTTPS keepalive timeout greater than 1000 seconds description : Disallow client HTTPS keepalive timeout values greater than 1000 seconds.

Use case

Syntax

Disallow client HTTPS keepalive timeout values greater than 1000 seconds

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.clientHTTPSKeepalive1000Sec 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/TargetHttpsProxy 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.httpKeepAliveTimeoutSec 
  
 > 
  
 1000" 
 actionType 
 : 
  
 DENY 
 displayName 
 : 
  
 Disallow client HTTPS keepalive timeout greater than 1000 seconds 
 description 
 : 
  
 Disallow client HTTPS keepalive timeout values greater than 1000 seconds.

URL maps

Use case Syntax

Use case	Syntax
Require URL maps to have a custom error response policy for HTTP `500` status codes	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.urlMapCustomResponseHTTP500 resourceTypes : - compute.googleapis.com/UrlMaps methodTypes : - CREATE - UPDATE condition : "resource.defaultCustomErrorResponsePolicy.errorResponseRule.exists(value, value.matchResponseCode == 500)" actionType : ALLOW displayName : Require URL maps to have a custom error response policy for HTTP 500 errors description : URL maps must have a custom error response policy configured for HTTP 500 errors.

Require URL maps to have a custom error response policy for HTTP 500 status codes

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.urlMapCustomResponseHTTP500 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/UrlMaps 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.defaultCustomErrorResponsePolicy.errorResponseRule.exists(value, 
  
 value.matchResponseCode 
  
 == 
  
 500)" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Require URL maps to have a custom error response policy for HTTP 500 errors 
 description 
 : 
  
 URL maps must have a custom error response policy configured for HTTP 500 errors.

Target instances

Use case	Syntax
Require target instances to have a name that starts with the string "targetInstance"	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.targetInstanceConstraint resourceTypes : - compute.googleapis.com/TargetInstance methodTypes : - CREATE - UPDATE condition : "resource.name.startsWith('targetInstance')" actionType : ALLOW displayName : Require target instances to have a name that starts with the string "targetInstance" description : Target instances must have resource names that start with the string "targetInstance"

Use case

Syntax

Require target instances to have a name that starts with the string "targetInstance"

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.targetInstanceConstraint 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/TargetInstance 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.name.startsWith('targetInstance')" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Require target instances to have a name that starts with the string "targetInstance" 
 description 
 : 
  
 Target instances must have resource names that start with the string "targetInstance"

Target pools

Use case	Syntax
Require target pools to have a CLIENT_IP session affinity	name : organizations/ `ORGANIZATION_ID` /customConstraints/custom.targetPoolConstraint resourceTypes : - compute.googleapis.com/TargetPool methodTypes : - CREATE - UPDATE condition : "resource.sessionAffinity == 'CLIENT_IP'" actionType : ALLOW displayName : Require target pools to use CLIENT_IP session affinity description : Target pools must use CLIENT_IP session affinity

Use case

Syntax

Require target pools to have a CLIENT_IP session affinity

 name 
 : 
  
 organizations/ ORGANIZATION_ID 
/customConstraints/custom.targetPoolConstraint 
 resourceTypes 
 : 
 - 
  
 compute.googleapis.com/TargetPool 
 methodTypes 
 : 
 - 
  
 CREATE 
 - 
  
 UPDATE 
 condition 
 : 
  
 "resource.sessionAffinity 
  
 == 
  
 'CLIENT_IP'" 
 actionType 
 : 
  
 ALLOW 
 displayName 
 : 
  
 Require target pools to use CLIENT_IP session affinity 
 description 
 : 
  
 Target pools must use CLIENT_IP session affinity

Limitations

Legacy health checks ( Legacy global (HTTP) and Legacy global (HTTPS) ) are not supported.
For some Compute Engine resources, such as Compute Engine SSL policy resources, custom constraints are also enforced on the UPDATE method.

What's next

Learn more about organization policies .
Learn more about how to create and manage organization policies .
See the full list of predefined Organization policy constraints .

Manage Cloud Load Balancing resources using custom constraints Stay organized with collections Save and categorize content based on your preferences.

Benefits

Cloud Load Balancing supported resources

Backend buckets

Backend services

Forwarding rules

Health checks

Network endpoint groups

Service load balancing policy

SSL policies

Target instances

Target pools

Target proxies

URL maps

Policy inheritance

Before you begin

Console

gcloud

Required roles

Required permissions

Set up a custom constraint

Console

gcloud

Enforce a custom constraint

Console

gcloud

Example: Use custom constraints to restrict TLS capabilities

Example: Create a constraint that restricts TCP health check port to minimum 1024

gcloud

More examples for common use cases

Backend buckets

Backend services

Forwarding rules

Health checks

Target proxies

URL maps

Target instances

Target pools

Limitations

What's next

Manage Cloud Load Balancing resources using custom constraints