Resource types that accept allow policies

This page lists the resource types on which you can set allow policies.

Note: Allow policies set on a parent resource (a project, folder, or organization) are inherited by the resource's children, regardless of the policy set on the child resource itself. For example, if the allow policy for a project grants a user the ability to administer Compute Engine virtual machine (VM) instances, then the user can administer any Compute Engine VM in that project, regardless of the allow policy you set on each VM.

Select a service to see which of its resource types support allow policies:

All services BigQuery   Identity-Aware Proxy   Access Context Manager   Vertex AI   Analytics Hub   API Gateway   Apigee   Apigee Registry   App Hub   Artifact Registry   AutoML   Backup and Disaster Recovery   Chrome Enterprise Premium   BigQuery Connection API   BigQuery Data Policy   Bigtable   Binary Authorization   Cloud Billing   Cloud Build   Cloud Deploy   Cloud Run functions   Cloud Key Management Service   Resource Manager   Cloud Tasks   Compute Engine   Cloud Config Manager API   Artifact Analysis   Data Catalog   Dataform   Cloud Data Fusion   Database Migration Service   Dataplex   Dataproc   Cloud Deployment Manager   Cloud DNS   Cloud Domains   Eventarc   Backup for GKE   GKE Hub   Google Distributed Cloud   Cloud Healthcare API   Identity and Access Management   Cloud Intrusion Detection System   Cloud Logging   Looker   Managed Service for Microsoft Active Directory   Dataproc Metastore   AI Platform   Network Connectivity Center   Network Management API   Network Security   Network Services   Notebooks   Certificate Authority Service   Pub/Sub   Cloud Run   Secret Manager   Security Command Center   Service Directory   Service Management   Spanner   Cloud Storage   Google Cloud VMware Engine   Cloud Workstations  

Service	Resources that accept allow policies
BigQuery	Datasets Routines Tables
Identity-Aware Proxy	All web services Individual web services Tunnel Tunnel instances Tunnel zones Web service types Web service versions
Access Context Manager	Access policies
Vertex AI	Entity types Feature online stores Feature views Featurestores Models Notebook runtime templates
Analytics Hub	Data exchanges Listings Subscriptions
API Gateway	APIs Configs Gateways
Apigee	Deployments Environments
Apigee Registry	APIs Artifacts Deployments Documents Instances Runtime Specs Versions
App Hub	Applications
Artifact Registry	Repositories
AutoML	Datasets Locations Models
Backup and Disaster Recovery	Management servers
Chrome Enterprise Premium	App connections App connectors App gateways Applications Browser DLP rules Client connector services Client gateways Partner tenants Proxy configs Security gateways
BigQuery Connection API	Connections
BigQuery Data Policy	Data policies
Bigtable	Authorized views Backups Instances Tables
Binary Authorization	Attestors Policy
Cloud Billing	Billing accounts
Cloud Build	Connections
Cloud Deploy	Custom target types Delivery pipelines Targets
Cloud Run functions	Functions
Cloud Key Management Service	Crypto keys EKM config EKM connections Import jobs Key rings
Resource Manager	Folders Organizations Projects Tag keys Tag values
Cloud Tasks	Queues
Compute Engine	Backend buckets Backend services Disks Firewall policies Images Instance templates Instances Instant snapshots Licenses Machine images Network attachments Network firewall policies Node groups Node templates Region backend services Region disks Region instant snapshots Region network firewall policies Reservations Resource policies Service attachments Snapshots Storage pools Subnetworks
Cloud Config Manager API	Deployments
Artifact Analysis	Notes Occurrences
Data Catalog	Entry groups Policy tags Tag templates Taxonomies
Dataform	Repositories Workspaces
Cloud Data Fusion	Instances
Database Migration Service	Connection profiles Conversion workspaces Migration jobs Objects Private connections
Dataplex	Aspect types Assets Attributes Categories Content Content items Data attribute bindings Data scans Data taxonomies Encryption configs Entry groups Entry link types Entry types Environments Glossaries Governance rules Lakes Tasks Terms Zones
Dataproc	Autoscaling policies Clusters Jobs Operations Workflow templates
Cloud Deployment Manager	Deployments
Cloud DNS	Managed zones
Cloud Domains	Registrations
Eventarc	Channel connections Channels Enrollments Google API sources Message buses Pipelines Triggers
Backup for GKE	Backup plans Backups Restore plans Restores Volume backups Volume restores
GKE Hub	Features Memberships Scopes
Google Distributed Cloud	Bare metal admin clusters Bare metal clusters Bare metal node pools VMware admin clusters VMware clusters VMware node pools
Cloud Healthcare API	Consent stores Data mapper workspaces Datasets DICOM stores FHIR stores HL7v2 stores
Identity and Access Management	Service accounts Workforce identity pools
Cloud Intrusion Detection System	Endpoints
Cloud Logging	Views
Looker	Backups Instances
Managed Service for Microsoft Active Directory	Backups Domains Peerings
Dataproc Metastore	Backups Databases Federations Services Tables
AI Platform	Jobs Models
Network Connectivity Center	Groups Hubs Policy-based routes Service classes Service connection maps Service connection policies Spokes
Network Management API	Connectivity tests
Network Security	Address groups Authorization policies Authz policies Client TLS policies Server TLS policies
Network Services	Edge cache keysets Edge cache origins Edge cache services
Notebooks	Instances Runtimes
Certificate Authority Service	CA pools Certificate revocation lists Certificate templates
Pub/Sub	Schemas Snapshots Subscriptions Topics
Cloud Run	Jobs Services
Secret Manager	Secrets
Security Command Center	Sources
Service Directory	Namespaces Services
Service Management	Consumers Services
Spanner	Backup schedules Backups Databases Instances
Cloud Storage	Buckets Managed folders
Google Cloud VMware Engine	Clusters HCX activation keys Private clouds
Cloud Workstations	Workstation configs Workstations