[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eThis guide outlines the process of configuring an organization policy to enforce Binary Authorization for container images deployed to Cloud Run at the project, folder, or organization level.\u003c/p\u003e\n"],["\u003cp\u003eSetting this policy requires specific permissions, such as the \u003ccode\u003eorgpolicy.policyAdmin\u003c/code\u003e role, and can be done through the Google Cloud console or the \u003ccode\u003egcloud\u003c/code\u003e command-line tool.\u003c/p\u003e\n"],["\u003cp\u003eIt is recommended to use dry-run mode and review Cloud Audit Logs before making the policy more restrictive to avoid impacting running services.\u003c/p\u003e\n"],["\u003cp\u003eThe Binary Authorization policy can be set to \u003ccode\u003edefault\u003c/code\u003e, which configures it to use the policy in the same project as the Cloud Run services.\u003c/p\u003e\n"],["\u003cp\u003eYou can view and revert this policy at any time, and revert the policy using the Google Cloud console or the \u003ccode\u003egcloud\u003c/code\u003e tool.\u003c/p\u003e\n"]]],[],null,["# Require Binary Authorization for Cloud Run\n\nThis page describes how to configure an organization policy that requires\nBinary Authorization enforcement of container images that are deployed to\nCloud Run. You can require enforcement for a project, folder, or\nan organization.\n\nBefore you begin\n----------------\n\nYou must have permission to modify\n[organization policies](/resource-manager/reference/rest/v1/Policy) to set this\nconstraint. For example, the\n[`orgpolicy.policyAdmin`](/iam/docs/understanding-roles#organization-policy-roles)\nrole has permission to set organization policy constraints. The\n[`resourcemanager.organizationAdmin`](/resource-manager/docs/access-control-org)\nrole has permission to add a user as an Organization Policy Administrator.\nRead the\n[Using Constraints](/resource-manager/docs/organization-policy/using-constraints#add-org-policy-admin)\npage to learn more about managing policies at the organization level.\nYou can [use a custom constraint](/run/docs/securing/custom-constraints#require-binary)\nto require that Binary Authorization is set to `default` at the project\nlevel.\n\nSet the organization policy\n---------------------------\n\nThis section shows you how to set an organization policy to require\nBinary Authorization enforcement on images deployed to\nCloud Run. You can set the policy using the Google Cloud console\nor the Google Cloud CLI.\n**Warning:** Setting this policy can affect running services. If you have running services, we recommend you [enable dry-run mode in the policy](/binary-authorization/docs/enabling-dry-run) and review [Cloud Audit Logs entries for Cloud Run](/binary-authorization/docs/run/viewing-audit-logs-cloud-run) before updating the policy to be more restrictive. \n\n### Console\n\nTo set the organization policy using Google Cloud console, do the\nfollowing:\n\n1. In the Google Cloud console, go to the Organization policies page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. In the **Project Selector** at the top of the page, do the following:\n\n 1. Select the organization for which you want to set the policy.\n\n You can set the policy at the organization, folder or project level\n using the\n [folder ID](/resource-manager/docs/creating-managing-folders#configuring_access_to_folders)\n and\n [project ID](/resource-manager/docs/creating-managing-projects#identifying_projects),\n respectively.\n To learn more, see [Using constraints](/resource-manager/docs/organization-policy/using-constraints).\n 2. To complete the selection, click **Open**.\n\n3. In **Filter**, enter the following:\n\n Allowed Binary Authorization Policies (Cloud Run)\n\n4. To edit the policy details, in **Policy details** , click **Edit**.\n\n5. In **Applies to** , click **Customize**.\n\n | **Note:** You can inherit settings from a parent project or organization by clicking **Inherit parent's policy**.\n6. Make sure **Policy type** is set to `Allow`.\n\nTo set the default Binary Authorization policy that the organization\npolicy requires, do the following:\n\n1. In **Custom values** , in the text field, type `default`.\n\n The policy value must be set to `default`. Setting the value to\n `default` configures Binary Authorization to use the policy in the\n same project as your Cloud Run services.\n2. To save this organization policy, click **Save**.\n\n### gcloud\n\nTo set the organization policy using `gcloud`, do the following: \n\n```\ngcloud resource-manager org-policies allow run.allowedBinaryAuthorizationPolicies \\\n default \\\n --organization=ORGANIZATION_ID\n```\n\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the numeric ID of the\norganization.\n\nYou can also apply the organization policy to a folder or a project with the\n`--folder` or the `--project` flags, and the\n[folder ID](/resource-manager/docs/creating-managing-folders#configuring_access_to_folders)\nand\n[project ID](/resource-manager/docs/creating-managing-projects#identifying_projects),\nrespectively.\n| **Note:** It can take up to a few minutes for the organization policy to update and require Binary Authorization enforcement for Cloud Run.\n\nView the organization policy\n----------------------------\n\nYou can view the organization policy using the Google Cloud console or `gcloud`. \n\n### Console\n\n1. In the Google Cloud console, go to the Organization policies page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. In the **Project Selector**, select the organization for which you want\n to view the policy.\n\n3. In **Filter**, enter the following:\n\n Allowed Binary Authorization Policies (Cloud Run)\n\n4. To complete the selection, click **Open**.\n\n5. You can view the `Allowed Binary Authorization Policies (Cloud Run)`\n policy configuration.\n\n### gcloud\n\nTo view the organization policy that requires Binary Authorization for\nCloud Run on an organization, enter the following command: \n\n```\ngcloud resource-manager org-policies describe \\\n run.allowedBinaryAuthorizationPolicies \\\n --effective \\\n --organization=ORGANIZATION_ID\n```\n\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the numeric ID of the\norganization.\n\nRevert the policy\n-----------------\n\nYou can revert the policy so that Cloud Run no longer requires\nBinary Authorization enforcement using the Google Cloud console or\n`gcloud`. \n\n### Console\n\nTo revert the policy using the Google Cloud console, do the following:\n\n1. In the Google Cloud console, go to the Organization policies page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. In the **Project Selector**, select the organization for which you want\n to revert the policy.\n\n3. In **Filter**, enter the following:\n\n Allowed Binary Authorization Policies (Cloud Run)\n\n4. To complete the selection, click **Open**.\n\n5. To edit the policy details, in **Policy details** , click **Edit**.\n\n6. In **Applies to** , select `Inherit parent's policy`.\n\n7. To save the organization policy, click **Save**.\n\n### gcloud\n\nTo revert the policy using `gcloud`, do the following: \n\n```\ngcloud resource-manager org-policies delete \\\n run.allowedBinaryAuthorizationPolicies \\\n --organization=ORGANIZATION_ID\n```\n\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the numeric ID of the\norganization.\n\nThe command returns the following: \n\n Deleted [\u003cEmpty\u003e]\n\n\u003cbr /\u003e\n\nAlternatively, you can [view the org policy](#view_org_policy) and note that\nthe **Inheritance** is set to `Inherit`, instead of `custom` and there is no\ncustom value set.\n\nWhat's next\n-----------\n\n- [Enable Binary Authorization on a Cloud Run service](/binary-authorization/docs/run/enabling-binauthz-cloud-run)\n- [Deploy a prebuilt Cloud Run service](/run/docs/quickstarts/deploy-container)\n- [Configure a Binary Authorization policy](/binary-authorization/docs/configuring-policy-console)"]]
