Pada 15 September 2026, semua lingkungan Cloud Composer 1 dan Cloud Composer 2 versi 2.0.x akan mencapai akhir masa pakainya yang direncanakan, dan Anda tidak akan dapat menggunakannya. Sebaiknya rencanakan migrasi ke Cloud Composer 3.
Halaman ini menunjukkan cara mengonfigurasi batasan lokasi resource untuk memastikan bahwa data Anda yang disimpan oleh Cloud Composer disimpan dalam lokasi yang Anda tentukan.
Cara kerja batasan lokasi
Pembatasan lokasi untuk Cloud Composer ditentukan berdasarkan kebijakan organisasi yang diterapkan ke project tempat lingkungan Cloud Composer dibuat. Kebijakan ini ditetapkan
dalam project atau diwarisi dari organisasi.
Dengan pembatasan lokasi diaktifkan, Anda tidak dapat membuat lingkungan di wilayah yang dilarang oleh kebijakan. Jika suatu region tercantum dalam daftar Tolak, atau tidak tercantum dalam daftar Izinkan, Anda tidak dapat membuat lingkungan di region ini.
Untuk mengaktifkan pembuatan lingkungan, kebijakan harus mengizinkan seluruh wilayah,
bukan zona tertentu dalam wilayah ini. Misalnya, region europe-west3
harus diizinkan oleh kebijakan untuk membuat
lingkungan Cloud Composer di region ini.
Cloud Composer memeriksa batasan lokasi di:
Pembuatan lingkungan.
Upgrade lingkungan, jika ada resource tambahan yang dibuat selama
operasi.
Pembaruan lingkungan, untuk lingkungan lama yang tidak menerapkan pembatasan lokasi pada dependensi Cloud Composer.
Selain memeriksa batasan lokasi, Cloud Composer
melakukan hal berikut:
Menyimpan image Airflow yang disesuaikan pengguna di repositori Artifact Registry regional.
Jika multi-region US secara eksplisit dilarang oleh
kebijakan, penggunaan Cloud Build akan dinonaktifkan. Dalam hal ini, image Airflow yang disesuaikan pengguna akan di-build di cluster GKE Anda.
Menginstal dependensi Python ke lingkungan IP pribadi dengan batasan lokasi resource
Jika Anda menetapkan batasan lokasi resource untuk project, Cloud Build tidak dapat digunakan untuk menginstal paket Python. Akibatnya,
akses langsung ke repositori di internet publik dinonaktifkan.
Untuk menginstal dependensi Python di lingkungan IP Pribadi saat
batasan lokasi Anda tidak mengizinkan multi-region US, gunakan salah satu opsi berikut:
Gunakan repositori PyPI pribadi yang dihosting di jaringan VPC Anda.
Gunakan
server proxy
di jaringan VPC untuk terhubung ke repositori PyPI di internet
publik. Tentukan alamat proxy dalam file /config/pip/pip.conf di
bucket Cloud Storage.
Jika kebijakan keamanan Anda mengizinkan akses ke jaringan VPC dari alamat IP eksternal, Anda dapat mengonfigurasi Cloud NAT.
Simpan dependensi Python di folder dags di bucket Cloud Storage, untuk menginstalnya sebagai library lokal.
Hal ini mungkin bukan opsi yang baik jika hierarki dependensi besar.
Membatasi lokasi untuk log Cloud Composer
Jika log Cloud Composer Anda berisi data sensitif, sebaiknya
alihkan log Cloud Composer ke bucket Cloud Storage
regional. Untuk melakukannya, gunakan
log sink. Setelah Anda mengalihkan log ke bucket Cloud Storage, log Anda tidak akan dikirim ke Cloud Logging.
LOCATION dengan region tempat lingkungan tersebut berada.
BUCKET_NAME dengan nama bucket. Contoh, composer-logs-us-central1-example-environment.
Buat log sink baru.
gcloudloggingsinkscreate\
composer-log-sink-ENVIRONMENT_NAME\
storage.googleapis.com/BUCKET_NAME\
--log-filter"resource.type=cloud_composer_environment AND \resource.labels.environment_name=ENVIRONMENT_NAME AND \resource.labels.location=LOCATION"
Ganti:
ENVIRONMENT_NAME dengan nama lingkungan.
BUCKET_NAME dengan nama bucket.
LOCATION dengan region tempat lingkungan tersebut berada.
Output perintah sebelumnya berisi nomor akun
layanan. Berikan peran Storage Object Creator ke akun layanan ini:
SA_NUMBER dengan nomor akun layanan yang diberikan oleh perintah gcloud logging sinks create pada langkah sebelumnya.
Kecualikan log untuk lingkungan Anda dari Logging.
gcloudloggingsinksupdate_Default\
--add-exclusionname=ENVIRONMENT_NAME-exclusion,filter=\"resource.type=cloud_composer_environment AND \resource.labels.environment_name=ENVIRONMENT_NAME AND \resource.labels.location=LOCATION"
Ganti:
ENVIRONMENT_NAME dengan nama lingkungan.
LOCATION dengan region tempat lingkungan tersebut berada.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-29 UTC."],[[["\u003cp\u003eCloud Composer environments' location restrictions are managed through organizational policies applied to the project, either directly or inherited.\u003c/p\u003e\n"],["\u003cp\u003eCreating environments in a region is only allowed if the entire region is listed in the policy's "Allow" list or not listed in the "Deny" list.\u003c/p\u003e\n"],["\u003cp\u003eWhen location restrictions prevent the use of the \u003ccode\u003eUS\u003c/code\u003e multi-region, Cloud Build cannot be utilized, therefore requiring alternative methods such as private PyPI repositories, proxy servers, or local libraries for installing Python dependencies in Private IP environments.\u003c/p\u003e\n"],["\u003cp\u003eCloud Composer logs, if containing sensitive information, can be redirected to a regional Cloud Storage bucket using a log sink, which will stop the logs from being sent to Cloud Logging.\u003c/p\u003e\n"]]],[],null,["\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\n[Cloud Composer 3](/composer/docs/composer-3/configure-resource-location-restrictions \"View this page for Cloud Composer 3\") \\| [Cloud Composer 2](/composer/docs/composer-2/configure-resource-location-restrictions \"View this page for Cloud Composer 2\") \\| **Cloud Composer 1**\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page shows how to configure\n[resource location restrictions](/resource-manager/docs/organization-policy/defining-locations)\nso that your data stored by Cloud Composer is kept within\nthe locations you specify.\n\nHow location restrictions work\n\nLocation restrictions for Cloud Composer are determined based\non the organizational policy that is applied to the project where\nthe Cloud Composer environment is created. This policy is assigned\neither within the project or is inherited from the organization.\n\nWith location restrictions enabled, it is not possible to create\nan environment in a region that is prohibited by the policy. If a region\nis listed in the Deny list, or is not listed in the Allow list, then you\ncannot create environments in this region.\n\nTo enable the creation of environments, the policy must allow the whole region\nand not a specific zone within this region. For example, the `europe-west3`\nregion must be allowed by the policy in order to create\nCloud Composer environments in this region.\n\nCloud Composer checks location restrictions at:\n\n- Environment creation.\n- Environment upgrade, if any additional resources are created during the operation.\n- Environment update, for older environments that do not enforce location restrictions on Cloud Composer dependencies.\n\nIn addition to checking the location restrictions, Cloud Composer\ndoes the following:\n\n- Stores user-customized Airflow images in regional Artifact Registry repositories. As an example, such images are created when you install custom PyPI images in your environment.\n- If the [`US` multi-region](/storage/docs/locations#location-mr) is explicitly prohibited by the policy, Cloud Build use is disabled. In this case, user-customized Airflow images are built in your environment's cluster.\n\nInstall a Python dependency to a private IP environment with resource location restrictions\n\nIf you set resource location restrictions for your project, then\nCloud Build can't be used to install Python packages. As a consequence,\ndirect access to repositories on the public internet is disabled.\n\nTo install Python dependencies in a Private IP environment when your\nlocation restrictions don't allow the [`US` multi-region](/storage/docs/locations#location-mr), use\none of the following options:\n\n- Use a private\n [PyPI repository hosted in your VPC network](/composer/docs/composer-1/install-python-dependencies#install-private-repo).\n\n- Use a\n [proxy server](https://pip.pypa.io/en/stable/user_guide/#using-a-proxy-server)\n in your VPC network to connect to a PyPI repository on the public\n internet. Specify the proxy address in the `/config/pip/pip.conf` file in\n the Cloud Storage bucket.\n\n- If your security policy permits access to your VPC network from external\n IP addresses, you can configure [Cloud NAT](/nat/docs/overview).\n\n- Store the Python dependencies in the `dags` folder in\n the Cloud Storage bucket, to\n [install them as local libraries](/composer/docs/composer-1/install-python-dependencies#install-local).\n This might not be a good option if the dependency tree is large.\n\nRestrict locations for Cloud Composer logs\n\nIf your Cloud Composer logs contain sensitive data, you might want\nto redirect Cloud Composer logs to a regional\nCloud Storage bucket. To do so, use\na [log sink](/logging/docs/export/configure_export_v2). After you redirect logs to\na Cloud Storage bucket, your logs are not sent to Cloud Logging.\n**Caution:** To get support from Cloud Customer Care, you might need to grant Google support engineers access to the Cloud Composer logs stored in Cloud Storage. \n\ngcloud\n\n1. Create a new Cloud Storage bucket.\n\n gcloud storage buckets create gs://\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\n\n Replace:\n - `LOCATION` with the region where the environment is located.\n - `BUCKET_NAME` with the name of the bucket. For example, `composer-logs-us-central1-example-environment`.\n2. Create a new log sink.\n\n gcloud logging sinks create \\\n composer-log-sink-\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e \\\n storage.googleapis.com/\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e \\\n --log-filter \"resource.type=cloud_composer_environment AND \\\n resource.labels.environment_name=\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e AND \\\n resource.labels.location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n\n Replace:\n - `ENVIRONMENT_NAME` with the name of the environment.\n - `BUCKET_NAME` with the name of the bucket.\n - `LOCATION` with the region where the environment is located.\n3. The output of the previous command contains the service\n account number. Grant the **Storage Object Creator** role to this\n service account:\n\n gcloud projects add-iam-policy-binding \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --member=\"serviceAccount:\u003cvar translate=\"no\"\u003eSA_NUMBER\u003c/var\u003e@gcp-sa-logging.iam.gserviceaccount.com\" \\\n --role='roles/storage.objectCreator' \\\n --condition=None\n\n Replace:\n - `PROJECT_ID` with the [Project ID](/resource-manager/docs/creating-managing-projects).\n - `SA_NUMBER` with the service account number provided by the `gcloud logging sinks create` command on the previous step.\n4. Exclude the logs for your environment from Logging.\n\n **Caution:** [Audit logs](/logging/docs/audit) cannot be excluded. They are always sent to the default storage. \n\n gcloud logging sinks update _Default \\\n --add-exclusion name=\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e-exclusion,filter=\\\n \"resource.type=cloud_composer_environment AND \\\n resource.labels.environment_name=\u003cvar translate=\"no\"\u003eENVIRONMENT_NAME\u003c/var\u003e AND \\\n resource.labels.location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e\"\n\n Replace:\n - `ENVIRONMENT_NAME` with the name of the environment.\n - `LOCATION` with the region where the environment is located.\n\nWhat's next\n\n- [Cloud Composer security overview](/composer/docs/composer-1/composer-security-overview)\n- [Access control](/composer/docs/composer-1/access-control)"]]
