조직 관리자로서 코드형 인프라를 적용할 때 개발자가 준수해야 하는 정책을 정의해야 합니다. 조직의 정책 집합은 정책 라이브러리로 표시됩니다. 이 페이지에서는 중앙화된 정책 저장소를 만들고 제약조건을 추가하는 데 도움이 됩니다.
시작하기 전에
조직 정책 라이브러리를 저장하기 위해 비어 있는 Git 저장소가 필요합니다.
안전하게 연결하도록 Git를 구성해야 합니다. 예를 들어 git 저장소가 GitHub에 있는 경우 SSH로 GitHub에 연결에 설명된 프로세스를 따를 수 있습니다.
샘플 라이브러리 복제
Google은 개인 용도로 수정할 수 있는 사전 정의된 제약조건 템플릿 집합이 포함된 샘플 저장소를 제공합니다.
정책 라이브러리 샘플 저장소를 클론하여 POLICY_LIBRARY_REPO에 복제합니다.
git clone https://github.com/GoogleCloudPlatform/policy-library.git
cd policy-library
git remote set-url origin POLICY_LIBRARY_REPO
git push origin main
policies/templates에서 사용 가능한 제약조건 템플릿을 검토합니다.
ls policies/templates
사용할 제약조건 템플릿을 선택합니다. 이 예시에서는 Cloud Storage 버킷의 위치를 시행하는 gcp_storage_location_v1.yaml을 선택합니다.
policies/constraints 아래의 해당 템플릿에 해당하는 제약조건 YAML 파일을 만듭니다.
policy-library 저장소의 로컬 사본 내에서 다음 명령어를 사용하여 변경사항을 커밋하고 푸시합니다.
gitadd--all.gitcommit-m"Initial commit of policy library constraints"gitpush-uoriginmain
라이브러리 구조
정책 라이브러리 저장소에는 다음 디렉터리가 포함됩니다.
policies/ – 이 디렉터리에는 2개의 하위 디렉터리가 포함됩니다.
constraints/ – 이 디렉터리는 처음에 비어 있습니다. 제약조건 파일을 여기에 배치합니다.
templates/ – 이 디렉터리에는 사전 정의된 제약조건 템플릿이 포함됩니다.
validator/ – 이 디렉터리에는 .rego 파일 및 연결된 단위 테스트가 포함됩니다. 기존 제약조건 템플릿을 수정하거나 새 템플릿을 생성하려는 경우가 아니면 이 디렉터리를 수정할 필요가 없습니다. make build를 실행하면 해당 제약조건 템플릿 파일에서 Rego 콘텐츠가 인라인으로 설정됩니다.
주기적 업데이트
주기적으로 공개 저장소에서 변경사항을 가져와야 합니다. 여기에는 새 템플릿 및 Rego 파일이 포함될 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis page guides organization administrators on setting up a centralized policy repository, represented as a policy library, to define policies for developers using infrastructure as code.\u003c/p\u003e\n"],["\u003cp\u003eA pre-existing Git repository is required to store the policy library, and secure Git configuration is necessary for connection, which can be established by following the Github SSH process.\u003c/p\u003e\n"],["\u003cp\u003eA sample policy library from Google is provided, containing predefined constraint templates that can be duplicated, modified, and added to the organization's policy library.\u003c/p\u003e\n"],["\u003cp\u003eThe policy library repository has a specific structure with \u003ccode\u003epolicies/\u003c/code\u003e directory containing \u003ccode\u003econstraints/\u003c/code\u003e and \u003ccode\u003etemplates/\u003c/code\u003e subdirectories and a \u003ccode\u003evalidator/\u003c/code\u003e directory for Rego files, while periodic updates from the public repository should be made.\u003c/p\u003e\n"],["\u003cp\u003ePre-GA products and features from the provided content, such as this product, are available "as is" and may have limited support, as well as being subject to the Pre-GA Offerings Terms in the General Service Terms section.\u003c/p\u003e\n"]]],[],null,["# Create a policy library\n\n| **Preview**\n|\n|\n| This product or feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA products and features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nAs an organization administrator, you need to define policies that developers adhere to when applying infrastructure as code. Your organization's set of policies is represented as a policy library. This page helps you create a centralized policy repository and add constraints.\n\nBefore you begin\n----------------\n\n- You need an empty Git repository for storing your organization's policy library.\n- You need to configure Git to connect securely. For example, if your git repository is on GitHub, you can follow the process outlined in [Connecting to GitHub with SSH](https://docs.github.com/en/authentication/connecting-to-github-with-ssh).\n\nDuplicate the sample library\n----------------------------\n\nGoogle provides a sample repository that includes a set of pre-defined constraint templates which you can modify for your personal use.\n\n1. Clone the policy library sample repository and duplicate it to your \u003cvar translate=\"no\"\u003ePOLICY_LIBRARY_REPO\u003c/var\u003e:\n\n ```\n git clone https://github.com/GoogleCloudPlatform/policy-library.git\n cd policy-library\n git remote set-url origin POLICY_LIBRARY_REPO\n git push origin main\n ```\n2. Examine the available constraint templates in `policies/templates`:\n `ls policies/templates`\n\n3. Select the constraint templates you want to use. For this example, choose `gcp_storage_location_v1.yaml`, which enforces location for Cloud Storage buckets.\n\n4. Create constraint YAML files corresponding to those templates under `policies/constraints`.\n\n5. From inside your local copy of the `policy-library` repository, use the following commands to commit and push your changes:\n\n git add --all .\n git commit -m \"Initial commit of policy library constraints\"\n git push -u origin main\n\n### Library structure\n\nA policy library repository contains the following directories:\n\n- `policies/` -- This directory contains two subdirectories:\n\n - `constraints/` -- This directory is initially empty. Place your constraint files here.\n - `templates/` -- This directory contains pre-defined constraint templates.\n- `validator/` -- This directory contains the `.rego` files and their associated unit tests. You don't need to touch this directory unless you intend to modify existing constraint templates or create new ones. Running `make build` inlines the Rego content in the corresponding constraint template files.\n\nPeriodic updates\n----------------\n\nPeriodically you should pull any changes from the public repository, which might contain new templates and Rego files. \n\n git remote add public https://github.com/GoogleCloudPlatform/policy-library.git\n git pull public main\n git push origin main\n\nNext steps\n----------\n\nThe policy library contains a number of constraint templates and a `samples`\nfolder with example constraints. Read\n[Create Terraform constraints](/docs/terraform/policy-validation/create-terraform-constraints)\nor\n[Create CAI constraints](/docs/terraform/policy-validation/create-cai-constraints)\nfor details on how to write and use constraint templates and constraints."]]
