Organization Policy Constraints

GCP Basics · IAM & Security – Roles, Service Accounts, Federation, Org Policy and Secrets · Lesson 4 of 5

Organization policies restrict what can be configured (no external IPs, allowed regions, no SA keys) for everyone below the node, regardless of their IAM roles.

IAM decides who may act. The Organization Policy Service decides what configurations are allowed at all, even for an Owner.

flowchart TB
  ORG["Organization policy<br/>gcp.resourceLocations = asia-southeast1"] --> F["Folder Production<br/>inherits"]
  F --> P["Project dl-shop-prod"]
  P --> REQ["Create bucket in us-central1"]
  REQ --> DENY["Denied: violates constraint"]
  %% step ORG: The policy is set on the organization node and applies to everything below it.
  %% step F: The folder inherits it unless a policy there overrides or merges with it.
  %% step P: The project owner has full IAM rights in the project.
  %% step REQ: Someone tries to create a bucket outside the allowed locations.
  %% step DENY: The API refuses the request because the configuration breaks the constraint.

Constraints

A constraint is the rule type; a policy sets it on a node.

Type	Example constraint	Effect
Boolean	`iam.disableServiceAccountKeyCreation`	No new SA keys
Boolean	`compute.requireOsLogin`	OS Login on every VM
Boolean	`storage.uniformBucketLevelAccess`	No object ACLs
Boolean	`compute.skipDefaultNetworkCreation`	New projects get no `default` network
List	`compute.vmExternalIpAccess`	Only listed VMs (or none) may have external IPs
List	`gcp.resourceLocations`	Allowed regions, e.g. `in:asia-locations`
List	`iam.allowedPolicyMemberDomains`	Only identities from your Cloud Identity customer can be granted roles

You can also write custom constraints with CEL conditions on resource fields, for example “GKE clusters must enable Workload Identity”.

Inheritance and exceptions

Policies are inherited down the hierarchy.
A lower node can replace the parent policy or merge with it (inheritFromParent: true for list constraints).
Use tags in policy conditions to make exceptions, for example allow external IPs only on projects tagged env=sandbox.
Dry-run policies log what would be denied without blocking it: try a new policy for a week first.
Existing resources are usually not changed; only new create or update calls are checked.

# policy.yaml
name: projects/dl-shop-prod/policies/compute.vmExternalIpAccess
spec:
  rules:
  - denyAll: true

gcloud org-policies set-policy policy.yaml
gcloud org-policies describe compute.vmExternalIpAccess --project=dl-shop-prod --effective

Setting policies needs Organization Policy Administrator (roles/orgpolicy.policyAdmin), granted at the organization level.

Command	Meaning
`gcloud org-policies list --project=…`	Policies set on a project
`gcloud org-policies describe CONSTRAINT --effective --project=…`	Effective (merged) policy
`gcloud org-policies delete CONSTRAINT --project=…`	Remove the project override

Traps: Owner on a project cannot bypass an org policy; policies do not delete existing non-compliant resources; personal accounts without an organization cannot use most constraints.