This page provides a list of all available Google-managed organization policy constraints.
Automatically enforced constraints
If an organization policy isn't enforced, it inherits from its lowest ancestor where an organization policy is enforced. If no organization policy is enforced anywhere in the ancestor hierarchy, the Google-managed default behavior of the constraint is enforced.
If the Google-managed default behavior of an organization policy constraint restricts an operation, then that operation is restricted even if you never explicitly defined an organization policy. To allow those operations, you must create organization policies that override the parent policy.
The following organization policy constraints have a Google-managed default behavior that restricts operations:
Available constraints
You can create organization policies using the following constraints.
Managed constraints
| Service | Constraint | Description |
|---|---|---|
| Compute Engine | Allowed VLAN Attachment encryption settings |
This list constraint defines the allowed encryption settings for new VLAN Attachments. constraints/compute.managed.allowedVlanAttachmentEncryption
|
| Compute Engine | Block Compute Engine Preview Features |
This constraint blocks Compute Engine preview features by default. You can explicitly allow specific preview features by adding them to the allowedPreviewFeatures list. Alternatively, you can disable the constraint (set to not enforced) to allow all preview features. After a preview feature is allowed (either by using the allowed list or by disabling the constraint), it must also be enabled for the project before it can be used. Subsequently enforcing the constraint does not change the status of individual preview features already set. This constraint only applies to Compute Alpha API features. constraints/compute.managed.blockPreviewFeatures
|
| Compute Engine | Block Project-wide SSH Keys |
Preview: This constraint prevents the block-project-ssh-keys metadata key from being set to false at the project, project-zonal, or instance level for Compute Engine VMs within the organization, project, or folder where this constraint is enforced. By default, project-wide SSH keys are allowed and can be disabled at the project, project-zonal, or instance level using this metadata key. To allow project-wide SSH keys for specific VMs, you can exempt them from this policy using tags and conditional rules. constraints/compute.managed.blockProjectSshKeys
|
| Compute Engine | Disable Guest Attributes of Compute Engine metadata |
Preview: This constraint, when enforced, disables Compute Engine API access to the Guest Attributes of Compute Engine VMs. constraints/compute.managed.disableGuestAttributesAccess
|
| Compute Engine | Disable VM Nested Virtualization |
This boolean constraint disables hardware-accelerated nestedvirtualization for all Compute Engine VMs belonging to the organization, project, or folder where this constraint is set to constraints/compute.managed.disableNestedVirtualization
|
| Compute Engine | Disable Non-FIPS Compliant Machine Types |
Preview: This constraint, when enforced, prevents the creation or update of VM instances using machine types that are not FIPS compliant. By default, all machine types are allowed. You can exempt specific VMs using tags and conditional rules. constraints/compute.managed.disableNonFIPSMachineTypes
|
| Compute Engine | Restrict enabling VM serial port access metadata |
This constraint prevents the serial-port-enable metadata key from being set to true for Compute Engine VMs within the organization, project, or folder where this constraint is enforced. By default, serial port access can be enabled on a per-VM, per-zone, or per-project basis using this metadata key. To allow serial port access for specific VMs, you can exempt them from this policy using tags and conditional rules. constraints/compute.managed.disableSerialPortAccess
|
| Compute Engine | Disable VM serial port logging to Stackdriver |
This constraint, when enforced, disables serial port logging to Stackdriver from Compute Engine VMs. constraints/compute.managed.disableSerialPortLogging
|
| Compute Engine | Disable creation of Compute Engine instances that use the deprecated container startup agent (konlet). |
Preview: This boolean constraint prevents the creation of Compute Engine instances that use konlet, the deprecated container startup agent. When enabled, you can't create compute instances that have the `gce-container-declaration` metadata key.This constraint also prevents creation of compute instances from instance templates that contain the `gce-container-declaration` metadata key, which affects managed instance groups (MIGs) that use such instance templates. constraints/compute.managed.disableVmsWithContainerStartupAgent
|
| Compute Engine | Restricts usage of Global Internal DNS (gDNS) for projects that have a ZonalOnly DNS setting. |
This constraint, when enforced, restricts gDNS usage. This restriction disables gDNS VM creation and updating VMs to use gDNS. You can revert a zDNS project to gDNS, but this results in policy violation enforcement during subsequent Instance API invocations. Note: This policy requires explicitly setting the 'vmDnsSetting=ZonalOnly' metadata at the project or instance level for the policy to function as expected, even if the project default is already zonal DNS. constraints/compute.managed.disallowGlobalDns
|
| Compute Engine | Require OS Config |
This constraint, when enforced, requires enablement of VM Manager (OS Config) on all new projects. On new and existing projects, this constraint prevents metadata updates that disable VM Manager at the project, project-zonal, or instance level. You can allow specific VM instances to disable VM Manager. First apply tags to mark the instances, and then use conditional rules based on tag values to properly scope those instances out of enforcement. constraints/compute.managed.requireOsConfig
|
| Compute Engine | Require OS Login |
This constraint, when enforced, requires enablement of OS Login on all newly created Projects. On new and existing projects, this constraint prevents metadata updates that disable OS Login at the project, project-zonal, or instance level. You can allow specific VM instances to disable OS Login. First apply tags to mark the instances, and then use conditional rules based on tag values to properly scope those instances out of enforcement. constraints/compute.managed.requireOsLogin
|
| Compute Engine | Restrict Non-Confidential Computing |
Preview: Requires all new VMs to be created with Confidential Computing enabled. By default, new VMs are not required to use Confidential Computing. You can apply/exempt this constraint by using tags to mark VM Instances and then enforcing the constraint with conditional rules based on the applied tags. constraints/compute.managed.restrictNonConfidentialComputing
|
| Compute Engine | Restricts the use of protocol forwarding |
This constraint lets you restrict the types of protocol forwarding deployments (internal or external) that can be created in your organization. To configure the constraint, you specify an allowlist of the type of protocol forwarding deployment to be allowed. The allowlist can only include the following values:
constraints/compute.managed.restrictProtocolForwardingCreationForTypes
|
| Compute Engine | Define trusted image projects for boot disks |
Preview: This constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. By default, instances can be created from images in any project that shares images publicly or explicitly with the user. Where this constraint is enforced, only images from trusted projects are allowed as the source for new boot disks. Note: If a project is specified in both allowedValues and deniedValues, it will be denied. Note: This constraint doesn't support simulation by Policy Simulator for Organization Policy. constraints/compute.managed.trustedImageProjects
|
| Compute Engine | Restrict VM IP forwarding |
This constraint defines whether Compute Engine VM instances can enable IP forwarding. By default, if no policy is specified, any VM can enable IP forwarding in any virtual network. If enforced, this constraint will deny the creation or update of VM instances with IP forwarding enabled. You can allow specific VM instances to enable IP forwarding. First apply tags to mark the instances, and then use conditional rules based on tag values to properly scope those instances out of enforcement. constraints/compute.managed.vmCanIpForward
|
| Compute Engine | Restrict External IPs For VM instances |
This constraint defines whether Compute Engine VM instances are allowed to use IPv4 external IP addresses. By default, all VM instances are allowed to use external IP addresses. If enforced, this constraint will deny the creation or update of VM instances with IPv4 external IP addresses. This constraint will not restrict the usage of IPv6 external IP addresses. You can allow specific VM instances to use external IPv4 IP addresses. First apply tags to mark the instances, and then use conditional rules based on tag values to properly scope those instances out of enforcement. constraints/compute.managed.vmExternalIpAccess
|
| Google Kubernetes Engine | Enable Autopilot privileged admission control |
Enable allowlist-based admission control for privileged Autopilot workloads when creating or updating GKE clusters. CAUTION: Setting `allowAnyGKEPath` to `False` causes cluster creation and update to fail unless you include the `--autopilot-privileged-admission` flag with a value that conforms to the policy. This change affects all clusters in the organization, not just those in Autopilot mode. For details, see https://docs.cloud.google.com/kubernetes-engine/docs/concepts/about-autopilot-privileged-workloads#about-managed-constraint. constraints/container.managed.autopilotPrivilegedAdmission
|
| Google Kubernetes Engine | Require that the DenyServiceExternalIPs admission controller is enabled |
Require that the DenyServiceExternalIPs admission controller remains enabled in GKE clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#deny_external_IPs constraints/container.managed.denyServiceExternalIPs
|
| Google Kubernetes Engine | Require that Attribute-Based Access Control is disabled |
Reject requests to enable Attribute-Based Access Control (ABAC) on GKE clusters. ABAC is a legacy authentication method that's disabled by default in all new clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#leave_abac_disabled constraints/container.managed.disableABAC
|
| Google Kubernetes Engine | Require disabling the insecure kubelet read-only port in GKE clusters |
Require that the insecure kubelet read-only port (10255) remains disabled. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port constraints/container.managed.disableInsecureKubeletReadOnlyPort
|
| Google Kubernetes Engine | Require that client certificate authentication is disabled |
Don't manually enable the legacy method of client certificate authentication.. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication#disabling_authentication_with_a_client_certificate constraints/container.managed.disableLegacyClientCertificateIssuance
|
| Google Kubernetes Engine | Requires disabling RBAC bindings to system identities in GKE clusters. |
Disable non-default ClusterRoleBindings and RoleBindings that reference the system:anonymous, system:authenticated, or system:unauthenticated system identities when creating or updating GKE clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/best-practices/rbac#prevent-default-group-usage constraints/container.managed.disableRBACSystemBindings
|
| Google Kubernetes Engine | Disallow using the default Compute Engine service account as the node pool service account. |
Don't use the default Compute Engine service account as the cluster or node pool service account. Use a minimally-privileged IAM service account instead. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#use_least_privilege_sa constraints/container.managed.disallowDefaultComputeServiceAccount
|
| Google Kubernetes Engine | Require enabling Binary Authorization for GKE clusters. |
Enable Binary Authorization when creating or updating GKE clusters. For details, see https://cloud.google.com/binary-authorization/docs/setting-up. constraints/container.managed.enableBinaryAuthorization
|
| Google Kubernetes Engine | Require that Cloud Logging is enabled in GKE clusters |
Require that all GKE clusters use at least the default Cloud Logging configuration. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster#stackdriver_logging constraints/container.managed.enableCloudLogging
|
| Google Kubernetes Engine | Require using only the DNS-based endpoint to access GKE clusters. |
Enable the DNS-based endpoint for GKE control plane access and disable IP-based endpoints when creating or updating clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/latest/network-isolation#dns-based-endpoint. constraints/container.managed.enableControlPlaneDNSOnlyAccess
|
| Google Kubernetes Engine | Require enabling Google Groups for RBAC in GKE clusters. |
Enable Google Groups for RBAC when creating or updating GKE clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/google-groups-rbac. constraints/container.managed.enableGoogleGroupsRBAC
|
| Google Kubernetes Engine | Require enabling network policy enforcement in GKE clusters. |
Enable the use of Kubernetes NetworkPolicies by enabling network policy enforcement or GKE Dataplane V2. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/network-policy or https://cloud.google.com/kubernetes-engine/docs/how-to/dataplane-v2. constraints/container.managed.enableNetworkPolicy
|
| Google Kubernetes Engine | Require enabling private nodes in GKE clusters. |
Enable private nodes when creating or updating GKE clusters and node pools. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/latest/network-isolation#configure-cluster-networking. constraints/container.managed.enablePrivateNodes
|
| Google Kubernetes Engine | Require enabling self-managed secrets Encryption in GKE clusters. |
Enable Secret encryption with self-managed keys when creating or updating GKE clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets. constraints/container.managed.enableSecretsEncryption
|
| Google Kubernetes Engine | Require enabling Security Bulletin Notifications in GKE clusters. |
Enable Security Bulletin Notifications when creating or updating GKE clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-notifications#securitybulletin constraints/container.managed.enableSecurityBulletinNotifications
|
| Google Kubernetes Engine | Require enabling Shielded Nodes in GKE clusters |
Require that Shielded Nodes remain enabled. Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes constraints/container.managed.enableShieldedNodes
|
| Google Kubernetes Engine | Require enabling Workload Identity Federation for GKE. |
Enable Workload Identity Federation for GKE when creating or updating clusters. For details, see https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity. constraints/container.managed.enableWorkloadIdentityFederation
|
| Google Kubernetes Engine | Require GKE Control Plane Egress to be restricted (NONE) |
Require that the GKE Control Plane Egress is set to the secure 'NONE' mode. When enforced, this constraint ensures that the control plane has no public IP and all egress traffic is subject to strict allowlisting via a proxy. For more information, see Restrict egress traffic from the API server. constraints/container.managed.restrictControlPlaneEgress
|
| Dataflow | Block project SSH keys |
Disable project-wide SSH keys from accessing Dataflow Worker VMs. constraints/dataflow.managed.blockProjectSshKeys
|
| Dataflow | Disable public IPs |
Disable the use of public IPs on Dataflow Worker VMs. constraints/dataflow.managed.disableUsePublicIps
|
| Discovery Engine | Restrict allowed data sources for data connectors |
This constraint defines the allowed data sources for data connectors. When enforced, only the allowed data sources can be used for data connectors in projects with VPC Service Controls (VPC-SC) enabled or projects in the constraints/discoveryengine.managed.allowedDataSources
|
| Discovery Engine | Restrict egress domains for data connectors |
This constraint defines the allowed egress fully qualified domain names (FQDNs) for data connectors. When enforced, only URLs with an allowed FQDN can be used for data connectors in projects with VPC Service Controls (VPC-SC) enabled, or projects in the constraints/discoveryengine.managed.allowedEgressFqdns
|
| Discovery Engine | Disable custom MCP server connector for Gemini Enterprise |
This constraint, when enforced, restricts the creation of data connectors that use a custom MCP server as their data source. For more information, see Override the organization policy for Custom MCP data stores. constraints/discoveryengine.managed.disableCustomMcpServerConnector
|
| Essential Contacts | Restrict contact domains |
This constraint defines the set of allowed domains that email addresses added to Essential Contacts can have. constraints/essentialcontacts.managed.allowedContactDomains
|
| Firestore | Disable query enhancements for Firestore full text search |
This constraint, when enforced, prevents enabling query enhancements for Firestore full text search. constraints/firestore.managed.disableEnhancedTextSearch
|
| Firestore | Disable MongoDB compatible API data access for Firestore databases |
This constraint, when enforced, prevents Firestore databases from being created with the MongoDB compatible API enabled, or updated to enable it. constraints/firestore.managed.disableMongodbCompatibleDataAccessMode
|
| Identity and Access Management | Restrict allowed policy members in IAM allow policies |
This constraint defines the organization principal sets that can be granted IAM roles in your organization. constraints/iam.managed.allowedPolicyMembers
|
| Identity and Access Management | Disable binding access policy to resource |
This boolean constraint, when enforced, prevents binding V3 access policies to resources. If this constraint is not enforced, binding V3 access policies to resources is allowed. constraints/iam.managed.disableAccessPolicyBinding
|
| Identity and Access Management | Block service account API key bindings |
When enforced, disables creation of API Keys bound to service accounts, unless the API Key's API targets are non-empty and exclusively limited to the allowedServices. For more information, see Enable key binding to service accounts. constraints/iam.managed.disableServiceAccountApiKeyCreation
|
| Identity and Access Management | Disable service account creation |
This boolean constraint disables the creation of service accounts where this constraint is set to `True`. constraints/iam.managed.disableServiceAccountCreation
|
| Identity and Access Management | Disable service account key creation |
This constraint, when enforced, blocks service account key creation. constraints/iam.managed.disableServiceAccountKeyCreation
|
| Identity and Access Management | Disable service account key upload |
This boolean constraint disables the feature that allows uploading public keys to service accounts where this constraint is set to `True`. constraints/iam.managed.disableServiceAccountKeyUpload
|
| Identity and Access Management | Prevent privileged basic roles for default service accounts |
When this constraint is enforced, it prevents anyone from granting the Editor role ( constraints/iam.managed.preventPrivilegedBasicRolesForDefaultServiceAccounts
|
| Identity and Access Management | Allowed external Identity Providers for workloads in Cloud IAM |
Identity Providers that can be configured for workload authentication within Cloud IAM, specified by URI/URLs. This constraint is managed by Google. constraints/iam.managed.workloadIdentityPoolProviders
|
| Google Cloud Managed Service for Apache Kafka | Disable Kafka Connect Cluster Create And Update |
When this boolean constraint is enforced, creating andupdating Kafka Connect clusters will be disabled. constraints/managedkafka.managed.disableKafkaConnectClusterCreateAndUpdate
|
| Google Cloud Managed Service for Apache Kafka | Restrict Managed Kafka Public Clusters |
When this constraint is enforced, creating or updating Managed Kafka clusters with the public cluster feature enabled is not allowed. This prevents clusters from being accessible over the public internet. constraints/managedkafka.managed.restrictPublicClusters
|
| Pub/Sub | Disables Subscription Single Message Transforms (SMTs) |
Do not configure or modify this policy. This constraint is automatically configured during Assured Workloads onboarding and is only intended for advanced regulatory control for Assured Workloads. When this boolean constraint is enforced, Pub/Sub Subscriptions cannot set Single Message Transforms (SMTs). constraints/pubsub.managed.disableSubscriptionMessageTransforms
|
| Pub/Sub | Disables Topic Single Message Transforms (SMTs) |
Do not configure or modify this policy. This constraint is automatically configured during Assured Workloads onboarding and is only intended for advanced regulatory control for Assured Workloads. When this boolean constraint is enforced, Pub/Sub Topics cannot set Single Message Transforms (SMTs). constraints/pubsub.managed.disableTopicMessageTransforms
|
| Cloud Run | Disable ephemeral disk storage for Cloud Run services |
Prevents the use of ephemeral disk storage (emptyDir volumes backed by disk) in Cloud Run services. When enforced, emptyDir volumes must not use the 'Disk' medium. In-memory emptyDir volumes ('Memory') remain allowed. constraints/run.managed.disableEphemeralDisk
|
| Cloud Run | Prevent deploying Cloud Run services using inlined source code |
When enforced, this constraint prevents deploying Cloud Run services using inlined source code. If this constraint is not enforced, you can deploy Cloud Run services using inlined source by setting the constraints/run.managed.disableInlinedSource
|
| Cloud Run | Disable ephemeral disk storage for Cloud Run jobs |
Prevents the use of ephemeral disk storage (emptyDir volumes backed by disk) in Cloud Run jobs. When enforced, emptyDir volumes must not use the 'Disk' medium. In-memory emptyDir volumes ('Memory') remain allowed. constraints/run.managed.disableJobsEphemeralDisk
|
| Cloud Run | Disable ephemeral disk storage for Cloud Run worker pools |
Prevents the use of ephemeral disk storage (emptyDir volumes backed by disk) in Cloud Run worker pools. When enforced, emptyDir volumes must not use the 'Disk' medium. In-memory emptyDir volumes ('Memory') remain allowed. constraints/run.managed.disableWorkerPoolsEphemeralDisk
|
| Cloud Run | Require IAM invoker check for Cloud Run services |
When enforced, this constraint requires the IAM invoker check to be enabled on Cloud Run services. constraints/run.managed.requireInvokerIam
|
| Spanner |