[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis document explains how to enable or disable resource usage restrictions for non-compliant resources in Assured Workloads folders, which is enforced by the \u003ccode\u003egcp.restrictServiceUsage\u003c/code\u003e organization policy constraint.\u003c/p\u003e\n"],["\u003cp\u003eTo modify resource usage restrictions, users need specific IAM permissions, such as \u003ccode\u003eassuredworkloads.workload.update\u003c/code\u003e and \u003ccode\u003eorgpolicy.policy.set\u003c/code\u003e, typically granted through the "Assured Workloads Administrator" or "Assured Workloads Editor" roles.\u003c/p\u003e\n"],["\u003cp\u003eResource usage restrictions can be enabled to allow only compliant resources based on the control package's supported services or disabled to allow all GCP resources, using specific curl commands and replacing placeholder values with the user's unique token, service endpoint, organization ID, workload location, and workload ID.\u003c/p\u003e\n"],["\u003cp\u003eDifferent control packages (FedRAMP Moderate, FedRAMP High, CJIS, IL4, US Regions) have different supported and unsupported products, which are detailed in tables within this document.\u003c/p\u003e\n"],["\u003cp\u003eCertain API endpoints remain accessible even when resource usage restrictions are enabled, including Cloud Asset API, Cloud Logging API, Service Control, Cloud Monitoring API, and others as listed.\u003c/p\u003e\n"]]],[],null,["# Restrict resource usage for workloads\n=====================================\n\nThis page explains how to enable or disable restrictions for non-compliant\nresources in Assured Workloads folders. By default, each folder's\ncontrol package determines which\n[products are supported](/assured-workloads/docs/supported-products), thus\ndetermining which resources can be used. This functionality is enforced by the\n[`gcp.restrictServiceUsage` organization policy constraint](/resource-manager/docs/organization-policy/restricting-resources)\nthat is automatically applied on the folder when it is created.\n\nBefore you begin\n----------------\n\n### Required IAM roles\n\nTo modify resource usage restrictions, the caller must be granted\nIdentity and Access Management (IAM) permissions using either a\n[predefined role](/iam/docs/understanding-roles#predefined) that includes a\nwider set of permissions, or a\n[custom role](/iam/docs/understanding-roles#custom_roles) that is restricted to\nthe minimum necessary permissions.\n\nThe following permissions are required on the target\n[workload](/assured-workloads/docs/reference/rest/Shared.Types/Workload):\n\n- `assuredworkloads.workload.update`\n- `orgpolicy.policy.set`\n\nThese permissions are included in the following two roles:\n\n- **Assured Workloads Administrator** (`roles/assuredworkloads.admin`)\n- **Assured Workloads Editor** (`roles/assuredworkloads.editor`)\n\nSee [IAM roles](/assured-workloads/docs/iam-roles) for more\ninformation about roles for Assured Workloads.\n\nEnable resource usage restrictions\n----------------------------------\n\nTo enable resource usage restriction for a workload, run the following command.\nThis command applies restrictions on the Assured Workloads folder in\naccordance with the control package's supported services: \n\n curl -d '{ \"restrictionType\": \"ALLOW_COMPLIANT_RESOURCES\" }' \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e\" -X POST \\\n \"\u003cvar translate=\"no\"\u003eSERVICE_ENDPOINT\u003c/var\u003e/v1/organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eWORKLOAD_LOCATION\u003c/var\u003e/workloads/\u003cvar translate=\"no\"\u003eWORKLOAD_ID\u003c/var\u003e:restrictAllowedServices\"\n\nReplace the following placeholder values with your own:\n\n- \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e: The authentication token for the request, for example:\n `ya29.a0AfB_byDnQW7A2Vr5...tanw0427`\n\n If you have the Google Cloud SDK installed in your environment and are\n authenticated, you can use the `gcloud auth print-access-token` command:\n `-H \"Authorization: Bearer $(gcloud auth print-access-token)\" -X POST \\`\n- \u003cvar translate=\"no\"\u003eSERVICE_ENDPOINT\u003c/var\u003e: The desired\n [service endpoint](/assured-workloads/docs/reference/rest#service-endpoint),\n for example:\n `https://us-central1-assuredworkloads.googleapis.com`\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: The unique identifier of the Google Cloud\n organization, for example: `12321311`\n\n- \u003cvar translate=\"no\"\u003eWORKLOAD_LOCATION\u003c/var\u003e: The location of the workload, for example:\n `us-central1`\n\n- \u003cvar translate=\"no\"\u003eWORKLOAD_ID\u003c/var\u003e: The unique identifier of the workload, for example:\n `00-c25febb1-f3c1-4f19-8965-a25`\n\nAfter you replace the placeholder values, your request should look similar to the\nfollowing example: \n\n curl -d '{ \"restrictionType\": \"ALLOW_COMPLIANT_RESOURCES\" }' \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer ya29.a0AfB_byDnQW7A2Vr5...tanw0427\" -X POST \\\n \"https://us-central1-assuredworkloads.googleapis.com/v1/organizations/12321311/locations/us-central1/workloads/00-c25febb1-f3c1-4f19-8965-a25:restrictAllowedServices\"\n\nIf successful, the response will be empty.\n\nDisable resource usage restriction\n----------------------------------\n\nTo disable resource usage restriction for a workload, run the following command.\nThis command effectively removes all service and resource restrictions on the\nAssured Workloads folder: \n\n curl -d '{ \"restrictionType\": \"ALLOW_ALL_GCP_RESOURCES\" }' \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e\" -X POST \\\n \"\u003cvar translate=\"no\"\u003eSERVICE_ENDPOINT\u003c/var\u003e/v1/organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eWORKLOAD_LOCATION\u003c/var\u003e/workloads/\u003cvar translate=\"no\"\u003eWORKLOAD_ID\u003c/var\u003e:restrictAllowedServices\"\n\nReplace the following placeholder values with your own:\n\n- \u003cvar translate=\"no\"\u003eTOKEN\u003c/var\u003e: The authentication token for the request, for example:\n `ya29.a0AfB_byDnQW7A2Vr5...tanw0427`\n\n If you have the Google Cloud SDK installed in your environment and are\n authenticated, you can use the `gcloud auth print-access-token` command:\n `-H \"Authorization: Bearer $(gcloud auth print-access-token)\" -X POST \\`\n- \u003cvar translate=\"no\"\u003eSERVICE_ENDPOINT\u003c/var\u003e: The desired\n [service endpoint](/assured-workloads/docs/reference/rest#service-endpoint),\n for example:\n `https://us-central1-assuredworkloads.googleapis.com`\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: The unique identifier of the Google Cloud\n organization, for example: `12321311`\n\n- \u003cvar translate=\"no\"\u003eWORKLOAD_LOCATION\u003c/var\u003e: The location of the workload, for example:\n `us-central1`\n\n- \u003cvar translate=\"no\"\u003eWORKLOAD_ID\u003c/var\u003e: The unique identifier of the workload, for example:\n `00-c25febb1-f3c1-4f19-8965-a25`\n\nAfter you replace the placeholder values, your request should look similar to the\nfollowing example: \n\n curl -d '{ \"restrictionType\": \"ALLOW_ALL_GCP_RESOURCES\" }' \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer ya29.a0AfB_byDnQW7A2Vr5...tanw0427\" -X POST \\\n \"https://us-central1-assuredworkloads.googleapis.com/v1/organizations/12321311/locations/us-central1/workloads/00-c25febb1-f3c1-4f19-8965-a25:restrictAllowedServices\"\n\nIf successful, the response will be empty.\n\nSupported and unsupported products\n----------------------------------\n\nThe tables in this section include supported and unsupported products for\nvarious control packages. If you enable the default resource usage\nrestrictions, then only the supported products can be used. If you disable\nresource usage restrictions, then both supported and unsupported products can be\nused.\n\n### Data Boundary for FedRAMP Moderate\n\n### Data Boundary for FedRAMP High\n\n### Data Boundary for Criminal Justice Information Services (CJIS)\n\n### Data Boundary for Impact Level 4 (IL4)\n\n### US Data Boundary and Support\n\nService endpoints\n-----------------\n\nThis section lists the API endpoints that aren't blocked after you enable\nresource usage restriction. \n\nWhat's next\n-----------\n\n- See the [list of services that don't support resource usage restriction](/resource-manager/docs/organization-policy/restricting-resources-unsupported-services).\n- Learn which [products are supported](/assured-workloads/docs/supported-products) for each control package."]]
