CONSTRAINT_NAME: 새 커스텀 제약조건에 사용하려는 이름. 커스텀 제약조건은 custom.으로 시작해야 하며 대문자, 소문자 또는 숫자만 포함할 수 있습니다. 예를 들면 custom.disableEventarcAdvancedResources입니다. 이 필드의 최대 길이는 70자입니다.
커스텀 제약 조건은 다음 Eventarc 고급 리소스 유형에 적용됩니다.
Enrollment
GoogleApiSource
MessageBus
Pipeline
커스텀 제약조건 설정
새 커스텀 제약조건의 YAML 파일을 만든 후에는 조직에서 조직 정책에 사용할 수 있도록 설정해야 합니다. 커스텀 제약조건을 설정하려면 gcloud org-policies set-custom-constraint 명령어를 사용합니다.
CONSTRAINT_PATH를 커스텀 제약조건 파일의 전체 경로로 바꿉니다. 예를 들면 /home/user/customconstraint.yaml입니다.
완료되면 Google Cloud 조직 정책 목록에서 조직 정책으로 커스텀 제약조건을 사용할 수 있습니다.
커스텀 제약조건이 존재하는지 확인하려면 gcloud org-policies list-custom-constraints 명령어를 사용합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[],[],null,["# Disable Eventarc Advanced resources\n\n[Standard](/eventarc/standard/docs/overview)\n\nThis guide describes how to disable Eventarc Advanced resources\n[using custom organization policies](/eventarc/standard/docs/custom-constraints).\n\nEventarc Advanced is not compliant with\n[certifications and standards](/eventarc/docs/compliance) that are supported by\nEventarc Standard. If your organization requires compliance with\nthese standards, you can disable the creation or updating of\nEventarc Advanced resources.\n\nBefore you begin\n----------------\n\nBefore you disable Eventarc Advanced resources, make sure that\nthe following prerequisites are met:\n\n- You know your Google Cloud [organization ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n- To get the permissions that you need to manage custom organization policies, ask your administrator to grant you the [Organization Policy Administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`) IAM role on the organization resource.\n\nCreate a custom constraint\n--------------------------\n\nYou can create a custom constraint and use this custom constraint in an\norganization policy to prevent the creating and updating of new\nEventarc Advanced resources.\n| **Note:** Any existing Eventarc Advanced resources created prior to enabling the organization policy continue to function after you enable the policy.\n\n1. To create a custom constraint, create a YAML file using the following format:\n\n name: organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/customConstraints/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n resourceTypes:\n -eventarc.googleapis.com/Enrollment\n -eventarc.googleapis.com/GoogleApiSource\n -eventarc.googleapis.com/MessageBus\n -eventarc.googleapis.com/Pipeline\n methodTypes:\n - CREATE\n - UPDATE\n condition: \"true\"\n actionType: DENY\n description: \"Disable Eventarc Advanced resources\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: your organization ID, such as\n `123456789`.\n\n - \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e: the name you want for your new\n custom constraint. A custom constraint must start with `custom.`, and can\n only include uppercase letters, lowercase letters, or numbers. For\n example, `custom.disableEventarcAdvancedResources`. The maximum\n length of this field is 70 characters.\n\n The custom constraint applies to the following Eventarc Advanced\n resource types:\n - `Enrollment`\n - `GoogleApiSource`\n - `MessageBus`\n - `Pipeline`\n\nSet up a custom constraint\n--------------------------\n\nAfter you have created the YAML file for a new custom constraint, you must set it up to make it available for organization policies in your organization. To set up a custom constraint, use the `gcloud org-policies set-custom-constraint` command: \n\n```bash\ngcloud org-policies set-custom-constraint CONSTRAINT_PATH\n```\nReplace \u003cvar translate=\"no\"\u003eCONSTRAINT_PATH\u003c/var\u003e with the full path to your custom constraint file. For example, `/home/user/customconstraint.yaml`. Once completed, your custom constraints are available as organization policies in your list of Google Cloud organization policies. To verify that the custom constraint exists, use the `gcloud org-policies list-custom-constraints` command: \n\n```bash\ngcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID\n```\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the ID of your organization resource. For more information, see [Viewing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies#viewing_organization_policies).\n\nEnforce a custom organization policy\n------------------------------------\n\nYou can enforce a constraint by creating an organization policy that references it, and then applying that organization policy to a Google Cloud resource.\n\n### Console\n\n1. In the Google Cloud console, go to the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. From the project picker, select the project for which you want to set the organization policy.\n3. From the list on the **Organization policies** page, select your constraint to view the **Policy details** page for that constraint.\n4. To configure the organization policy for this resource, click **Manage policy**.\n5. On the **Edit policy** page, select **Override parent's policy**.\n6. Click **Add a rule**.\n7. In the **Enforcement** section, select whether enforcement of this organization policy is on or off.\n8. Optional: To make the organization policy conditional on a tag, click **Add condition** . Note that if you add a conditional rule to an organization policy, you must add at least one unconditional rule or the policy cannot be saved. For more information, see [Setting an organization policy with tags](/resource-manager/docs/organization-policy/tags-organization-policy).\n9. Click **Test changes** to simulate the effect of the organization policy. Policy simulation isn't available for legacy managed constraints. For more information, see [Test organization policy changes with Policy Simulator](/policy-intelligence/docs/test-organization-policies).\n10. To finish and apply the organization policy, click **Set policy**. The policy requires up to 15 minutes to take effect.\n\n### gcloud\n\n\nTo create an organization policy with boolean rules, create a policy YAML file that\nreferences the constraint: \n\n```yaml\n name: projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/policies/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n spec:\n rules:\n - enforce: true\n \n```\n\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project on which you want to enforce your constraint.\n- \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e: the name of the constraint you want to enforce. For example, `compute.disableAllIpv6`.\n\n\nTo enforce the organization policy containing the constraint, run the following command: \n\n```bash\n gcloud org-policies set-policy POLICY_PATH\n \n```\n\n\nReplace \u003cvar translate=\"no\"\u003ePOLICY_PATH\u003c/var\u003e with the full path to your organization policy\nYAML file. The policy requires up to 15 minutes to take effect.\n\nWhat's next\n-----------\n\n- Learn more about [organization policies](/resource-manager/docs/organization-policy/overview)\n- Understand [Eventarc Advanced](/eventarc/advanced/docs/overview)"]]
