Google OrgPolicy Policy
This page shows how to write Terraform for OrgPolicy Policy and write them securely.
The Policy in OrgPolicy can be configured in Terraform with the resource name
google_org_policy_policy. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
The following arguments are supported:
name- (Required) Immutable. The resource name of the Policy. Must be one of the following forms, where constraintname is the name of the constraint which this Policy configures:
organizations/[organization_id]/policies/[constraint_name]For example, "projects/123/policies/compute.disableSerialPortAccess". Note:
projects/[project_id]/policies/[constraint_name]is also an acceptable name for API requests, but responses will return the name using the equivalent project number.
parent- (Required) The parent of the resource.
spec- (Optional) Basic information about the Organization Policy.
spec block supports:
etag- An opaque tag indicating the current version of the
Policy, used for concurrency control. This field is ignored if used in a
CreatePolicyrequest. When the
Policyis returned from either a
etagindicates the version of the current
Policyto use when executing a read-modify-write loop. When the
Policyis returned from a
etagwill be unset.
inherit_from_parent- (Optional) Determines the inheritance behavior for this
inherit_from_parentis true, PolicyRules set higher up in the hierarchy (up to the closest root) are inherited and present in the effective policy. If it is false, then no rules are inherited, and this Policy becomes the new root for evaluation. This field can be set only for Policies which configure list constraints.
reset- (Optional) Ignores policies set above this resource and restores the
constraint_defaultenforcement behavior of the specific
Constraintat this resource. This field can be set in policies for either list or boolean constraints. If set,
rulesmust be empty and
inherit_from_parentmust be set to false.
rules- (Optional) Up to 10 PolicyRules are allowed. In Policies for boolean constraints, the following requirements apply: - There must be one and only one PolicyRule where condition is unset. - BooleanPolicyRules with conditions must set
enforcedto the opposite of the PolicyRule without a condition. - During policy evaluation, PolicyRules with conditions that are true for a target resource take precedence.
update_time- Output only. The time stamp this was previously updated. This represents the last time a call to
UpdatePolicywas made for that
rules block supports:
allow_all- (Optional) Setting this to true means that all values are allowed. This field can be set only in Policies for list constraints.
condition- (Optional) A condition which determines whether this rule is used in the evaluation of the policy. When set, the
expressionfield in the `Expr' must include from 1 to 10 subexpressions, joined by the "||" or "&&" operators. Each subexpression must be of the form "resource.matchTag('/tag_key_short_name, 'tag_value_short_name')". or "resource.matchTagId('tagKeys/key_id', 'tagValues/value_id')". where key_name and value_name are the resource names for Label Keys and Values. These names are available from the Tag Manager Service. An example expression is: "resource.matchTag('123456789/environment, 'prod')". or "resource.matchTagId('tagKeys/123', 'tagValues/456')".
deny_all- (Optional) Setting this to true means that all values are denied. This field can be set only in Policies for list constraints.
enforce- (Optional) If
true, then the
Policyis enforced. If
false, then any configuration is acceptable. This field can be set only in Policies for boolean constraints.
values- (Optional) List of values to be used for this PolicyRule. This field can be set only in Policies for list constraints.
condition block supports:
description- (Optional) Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
expression- (Optional) Textual representation of an expression in Common Expression Language syntax.
location- (Optional) Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
title- (Optional) Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
values block supports:
allowed_values- (Optional) List of values allowed at this resource.
denied_values- (Optional) List of values denied at this resource.
In addition to the arguments listed above, the following computed attributes are exported:
id- an identifier for the resource with format