이 문서에서는 Cloud Interconnect를 사용할 수 있는 Virtual Private Cloud(VPC) 네트워크 집합을 제한하는 방법을 설명합니다.
기본적으로 모든 VPC 네트워크에서 Cloud Interconnect를 사용할 수 있습니다.
Cloud Interconnect를 사용할 수 있는 VPC 네트워크를 제어하려면 조직 정책을 설정하면 됩니다. 조직 정책에 대한 일반적인 정보는 조직 정책 서비스 소개를 참조하세요.
Cloud Interconnect를 사용하여 온프레미스 네트워크에 VPC 네트워크를 연결하려면 VLAN 연결이 필요합니다.
Cloud Interconnect 사용을 제한하는 조직 정책은 지정된 VPC 네트워크에서 VLAN 연결 생성을 허용하거나 거부합니다. 특정 VPC 네트워크 또는 프로젝트, 폴더, 조직 리소스의 모든 VPC 네트워크에서 VLAN 연결 생성을 허용하거나 거부하는 정책을 설정할 수 있습니다.
이 제약조건은 Partner Interconnect를 사용하여 VLAN 연결을 만들 때 사용할 수 있는 VPC 네트워크 집합을 정의합니다.
조직 정책을 설정하면 이후 VLAN 연결 생성이 제한됩니다. 이 정책은 이전에 만든 VLAN 연결에 영향을 주지 않습니다.
사용자가 조직 정책을 위반하는 VLAN 연결을 만들려고 하면 오류 메시지가 표시됩니다. 다음은 gcloud compute interconnects attachments partner create를 실행하는 오류 메시지 예시입니다.
ERROR: (gcloud.compute.interconnects.attachments.partner.create) Could not fetch resource:
- Constraint constraints/compute.restrictPartnerInterconnectUsage violated for projects/example-project.
projects/example-project/global/networks/example-network is not allowed to use the Partner Interconnect.
이 페이지에는 Cloud Interconnect 사용을 제한하기 위해 조직 정책을 설정하는 절차의 예시가 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Restrict Cloud Interconnect usage\n\nThis document describes how to restrict the set of Virtual Private Cloud (VPC)\nnetworks that can use Cloud Interconnect.\n\nBy default, any VPC network can use Cloud Interconnect.\nTo control which VPC networks can use Cloud Interconnect,\nyou can set an organization policy. For general information about organization\npolicies, see\n[Introduction to the Organization Policy Service](/resource-manager/docs/organization-policy/overview).\n\nUsing Cloud Interconnect to connect a VPC network to\nyour on-premises network requires a\n[VLAN attachment](/network-connectivity/docs/interconnect/how-to/dedicated/creating-vlan-attachments).\nAn organization policy for restricting Cloud Interconnect\nusage allows or denies the creation of VLAN attachments from specified\nVPC networks. You can set a policy that allows or denies the\ncreation of VLAN attachments from a specific VPC network or all\nVPC networks in a project, folder, or organization resource.\n\nYou can use the following constraints when defining your policy:\n\n- `constraints/compute.restrictDedicatedInterconnectUsage`\n\n This constraint defines the set of VPC networks that you can\n use when creating a VLAN attachment using Dedicated Interconnect.\n- `constraints/compute.restrictPartnerInterconnectUsage`\n\n This constraint defines the set of VPC networks that you can\n use when creating a VLAN attachment using Partner Interconnect.\n\nWhen you set an organization policy, it only constrains the creation of VLAN\nattachments in the future. The policy does not affect previously created VLAN\nattachments.\n\nIf a user attempts to create a VLAN attachment that violates an organization\npolicy, they see an error message. The following is an example error message\nfrom running `gcloud compute interconnects attachments partner create`: \n\n```\nERROR: (gcloud.compute.interconnects.attachments.partner.create) Could not fetch resource:\n- Constraint constraints/compute.restrictPartnerInterconnectUsage violated for projects/example-project.\nprojects/example-project/global/networks/example-network is not allowed to use the Partner Interconnect.\n```\n\nThis page includes example procedures for setting organization policies\nto restrict Cloud Interconnect usage.\n\nFor more information, including general procedures for setting organization\npolicies, see the following:\n\n- [Understanding constraints](/resource-manager/docs/organization-policy/understanding-constraints)\n- [Using constraints](/resource-manager/docs/organization-policy/using-constraints)\n- [Creating and managing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies)\n\nBefore you begin\n----------------\n\nTo set organization policies, you must have the\n[Organization Policy Administrator role](/iam/docs/understanding-roles#organization-policy-roles)\n(`roles/orgpolicy.policyAdmin`).\n\nSet a policy to deny a specific VPC network\n-------------------------------------------\n\nTo set a policy to deny a specific VPC network from using\nCloud Interconnect, follow these steps:\n\n1. Find your organization ID by entering the following command:\n\n ```\n gcloud organizations list\n ```\n\n The command output looks like the following example: \n\n ```\n DISPLAY NAME ID\n example-organization 29252605212\n ```\n2. Create a JSON file that defines your policy. The following example JSON\n file defines a policy that prevents `network-1` in `project-1` from using\n Dedicated Interconnect:\n\n ```\n {\n \"Constraint\": \"constraints/compute.restrictDedicatedInterconnectUsage\",\n \"listPolicy\": {\n \"deniedValues\": [\n \"projects/project-1/global/networks/network-1\"\n ]\n }\n }\n ```\n3. Use the `gcloud` Resource Manager `set-policy` command to set the organization\n policy:\n\n ```\n gcloud resource-manager org-policies set-policy JSON_FILE_NAME\n --organization=ORGANIZATION_ID\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eJSON_FILE_NAME\u003c/var\u003e: the name of the JSON file that you\n created in the previous step, such as `policy-name.json`\n\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the ID of the organization that you\n previously found\n\nSet a policy to deny all VPC networks\n-------------------------------------\n\nTo set a policy to deny all VPC networks from using\nCloud Interconnect, follow these steps:\n\n1. Find your organization ID by entering the following command:\n\n ```\n gcloud organizations list\n ```\n\n The command output looks like the following example: \n\n ```\n DISPLAY NAME ID\n example-organization 29252605212\n ```\n2. Create a JSON file that defines your policy. The following example JSON\n file defines a policy that prevents all VPC networks from\n using Dedicated Interconnect:\n\n ```\n {\n \"Constraint\": \"constraints/compute.restrictDedicatedInterconnectUsage\",\n \"listPolicy\": {\n \"allValues\": \"DENY\"\n }\n }\n ```\n3. Use the `gcloud` Resource Manager `set-policy` command to set the organization\n policy:\n\n ```\n gcloud resource-manager org-policies set-policy JSON_FILE_NAME\n --organization=ORGANIZATION_ID\n ```\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eJSON_FILE_NAME\u003c/var\u003e: the name of the JSON file that you\n created in the previous step, such as `policy-name.json`\n\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: the ID of the organization that you\n previously found\n\nSet a policy at the organization, folder, or project level\n----------------------------------------------------------\n\nThe previous sections describe how to deny a specific VPC network\nor all VPC networks. You can also use the syntax described in\n[List constraints](/resource-manager/docs/organization-policy/understanding-constraints#list_constraint)\nto allow or deny VPC networks at the organization, project, or\nfolder level.\n\nWhat's next\n-----------\n\n- To learn more about Cloud Interconnect options, see the\n [Cloud Interconnect overview](/network-connectivity/docs/interconnect/concepts/overview).\n\n- To help you solve common issues that you might encounter when using\n Cloud Interconnect, see\n [Troubleshooting](/network-connectivity/docs/interconnect/support/troubleshooting)."]]
