ResourceManagerPolicy

---

This resource is able to configure organization policy constraints for a project, folder, or organization. The parent resource is configured by setting one of projectRef, folderRef, or organizationRef.

Property	Value
Google Cloud Service Name	Cloud Resource Manager
Google Cloud Service Documentation	/resource-manager/docs/
Google Cloud REST Resource Name	v1.policy
Google Cloud REST Resource Documentation	/resource-manager/reference/rest/v1/Policy
Config Connector Resource Short Names	gcpresourcemanagerpolicy gcpresourcemanagerpolicies resourcemanagerpolicy
Config Connector Service Name	cloudresourcemanager.googleapis.com
Config Connector Resource Fully Qualified Name	resourcemanagerpolicies.resourcemanager.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember	No
Config Connector Default Average Reconcile Interval In Seconds	600

Custom Resource Definition Properties

Spec

Schema

booleanPolicy:
  enforced: boolean
constraint: string
folderRef:
  external: string
  name: string
  namespace: string
listPolicy:
  allow:
    all: boolean
    values:
    - string
  deny:
    all: boolean
    values:
    - string
  inheritFromParent: boolean
  suggestedValue: string
organizationRef:
  external: string
  name: string
  namespace: string
projectRef:
  external: string
  name: string
  namespace: string
restorePolicy:
  default: boolean
version: integer

Fields
booleanPolicy Optional	object A boolean policy is a constraint that is either enforced or not.
booleanPolicy.enforced Required*	boolean If true, then the Policy is enforced. If false, then any configuration is acceptable.
constraint Required	string Immutable. The name of the Constraint the Policy is configuring, for example, serviceuser.services.
folderRef Optional	object The folder on which to configure the constraint. Only one of projectRef, folderRef, or organizationRef may be specified.
folderRef.external Optional	string Allowed value: The `name` field of a `Folder` resource.
folderRef.name Optional	string Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
folderRef.namespace Optional	string Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
listPolicy Optional	object A policy that can define specific values that are allowed or denied for the given constraint. It can also be used to allow or deny all values. .
listPolicy.allow Optional	object One or the other must be set.
listPolicy.allow.all Optional	boolean The policy allows or denies all values.
listPolicy.allow.values Optional	list (string) The policy can define specific values that are allowed or denied.
listPolicy.allow.values[] Optional	string
listPolicy.deny Optional	object One or the other must be set.
listPolicy.deny.all Optional	boolean The policy allows or denies all values.
listPolicy.deny.values Optional	list (string) The policy can define specific values that are allowed or denied.
listPolicy.deny.values[] Optional	string
listPolicy.inheritFromParent Optional	boolean If set to true, the values from the effective Policy of the parent resource are inherited, meaning the values set in this Policy are added to the values inherited up the hierarchy.
listPolicy.suggestedValue Optional	string The Google Cloud Console will try to default to a configuration that matches the value specified in this field.
organizationRef Optional	object The organization on which to configure the constraint. Only one of projectRef, folderRef, or organizationRef may be specified.
organizationRef.external Optional	string Allowed value: The `name` field of an `Organization` resource.
organizationRef.name Optional	string Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
organizationRef.namespace Optional	string Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
projectRef Optional	object The project on which to configure the constraint. Only one of projectRef, folderRef, or organizationRef may be specified.
projectRef.external Optional	string Allowed value: The `name` field of a `Project` resource.
projectRef.name Optional	string Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
projectRef.namespace Optional	string Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
restorePolicy Optional	object A restore policy is a constraint to restore the default policy.
restorePolicy.default Required*	boolean May only be set to true. If set, then the default Policy is restored.
version Optional	integer Version of the Policy. Default version is 0.

* Field is required when parent field is specified

Status

Schema

conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
etag: string
observedGeneration: integer
updateTime: string

Fields
conditions	list (object) Conditions represent the latest available observation of the resource's current state.
conditions[]	object
conditions[].lastTransitionTime	string Last time the condition transitioned from one status to another.
conditions[].message	string Human-readable message indicating details about last transition.
conditions[].reason	string Unique, one-word, CamelCase reason for the condition's last transition.
conditions[].status	string Status is the status of the condition. Can be True, False, Unknown.
conditions[].type	string Type is the type of the condition.
etag	string The etag of the organization policy. etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other.
observedGeneration	integer ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
updateTime	string The timestamp in RFC3339 UTC "Zulu" format, accurate to nanoseconds, representing when the variable was last updated. Example: "2016-10-09T12:33:37.578138407Z".

Sample YAML(s)

Organization Policy For Folder

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: ResourceManagerPolicy
metadata:
  name: resourcemanagerpolicy-sample-folder
spec:
  folderRef:
    name: resourcemanagerpolicy-dep-folder
  constraint: "constraints/compute.disableSerialPortAccess"
  booleanPolicy:
    enforced: true
---
apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: Folder
metadata:
  annotations:
    # Replace "${ORG_ID?}" with the numeric ID for your organization
    cnrm.cloud.google.com/organization-id: "${ORG_ID?}"
  name: resourcemanagerpolicy-dep-folder
spec:
  displayName: Organization Policy Sample

Organization Policy For Organization

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: ResourceManagerPolicy
metadata:
  name: resourcemanagerpolicy-sample-org
spec:
  organizationRef:
    # Replace "${ORG_ID?}" with the numeric ID for your organization
    external: "${ORG_ID?}"
  constraint: "constraints/compute.disableSerialPortAccess"
  booleanPolicy:
    enforced: true

Organization Policy For Project

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: ResourceManagerPolicy
metadata:
  name: resourcemanagerpolicy-sample-proj
spec:
  projectRef:
    name: resourcemanagerpolicy-dep-proj
  constraint: "constraints/compute.disableSerialPortAccess"
  booleanPolicy:
    enforced: true
---
apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
kind: Project
metadata:
  annotations:
    # Replace "${ORG_ID?}" with the numeric ID for your folder
    cnrm.cloud.google.com/organization-id: "${ORG_ID?}"
  name: resourcemanagerpolicy-dep-proj
spec:
  name: Org Policy Sample

Note: If you have any trouble with instantiating the resource, refer to Troubleshoot Config Connector.