Using constraints

This guide explains how to create an organization policy with a particular constraint. The constraints used in the examples on this page will not be actual constraints, but generalized samples for educational purposes.

For more information on constraints and the problems they solve, review the list of all Organization Policy Service constraints.

Before you begin

• Read the Introduction to the Organization Policy Service page to learn how organization policy works.

• Read the Understanding constraints page to learn how constraints are constructed.

• Read the Understanding hierarchy evaluation page to learn about policy inheritance.

Add an organization policy administrator

To add a user as an Organization Policy Administrator, you must have the Organization Administrator role. This role can only be granted at the Organization level. You must have the Organization Policy Administrator role to set or change organization policies.

Console

To add an organization policy administrator:

1. Sign in to the Google Cloud Console as a Google Workspace or Cloud Identity super administrator and go to the IAM & Admin page:

   Open the IAM & admin page

2. Select the organization you want to edit:

   1. Click the project drop-down list at the top of the page.

   2. In the Select from dialog, click the organization drop-down list, and select the organization to which you want to add an organization policy administrator.

   3. On the list that appears, click the organization to open its IAM Permissions page.

3. Click Add, and then enter the email address of one or more users you want to set as organization policy administrators.

4. In the Select a role drop-down list, select Organization Policy > Organization Policy Administrator.

5. Click Save. A dialog will appear to confirm the addition or update of the member's new role.

gcloud

You can use JSON or YAML files with the gcloud commands. This example uses JSON.

To add an organization policy administrator to your organization:

1. Get the IAM policy that you want to modify, and write it to a JSON file:
   

     gcloud organizations get-iam-policy ORGANIZATION_ID \
        --format json > JSON_FILE
     

2. The contents of the JSON file will be similar to the following. Note that the version field is read-only, so you won't need to supply it.

   {
       "bindings": [
       {
           "members": [
             "user:[e-mail]"
           ],
           "role": "roles/owner"
       },
       {
           "members": [
             "serviceAccount:[e-mail]",
             "serviceAccount:[e-mail]"
           ],
           "role": "roles/editor"
       }
       ],
       "etag": "BwUjMhCsNvY=",
       "version": 1
   }
   

Where JSON_FILE is the path to the JSON file containing your IAM policy. For example, `iam.json`.
3. Use a text editor to add a new object to the bindings array that defines the group members and the role for those members. For example, to grant the role roles/orgpolicy.policyAdmin to the user [e-mail], change the example above as follows:

   {
     "bindings": [
     {
       "members": [
         "user:[e-mail]"
       ],
     "role": "roles/owner"
     },
     {
       "members": [
         "serviceAccount:[e-mail]",
         "serviceAccount:[e-mail]"
       ],
       "role": "roles/editor"
     },
     {
       "members": [
         "user:[e-mail]"
       ],
       "role": "roles/orgpolicy.policyAdmin"
     }
     ],
     "etag": "BwUjMhCsNvY="
   }
   

4. Update the organization's policy by running the following command:

   gcloud organizations set-iam-policy ORGANIZATION_ID iam.json
   

5. The command outputs the updated policy:

      bindings:
        - members:
          - user:[e-mail]
            role: roles/owner
        - members:
          - serviceAccount:[e-mail]
          - serviceAccount:[e-mail]
            role: roles/editor
        - members:
          - user:[e-mail]
            role: roles/orgpolicy.policyAdmin
        etag: BwUjMhXbSPU=
        version: 1
      

Using list constraints with an organization policy

Set up enforcement on the organization resource

You can set an organization policy on your organization resource that uses a list constraint to deny access to a particular service. The following process describes how to set an organization policy using the gcloud command-line tool. For instructions on how to view and set organization policies using the Cloud Console, see Creating and Managing Policies.

v2 API

1. Get the current policy on the organization resource using the describe command. This command returns the policy directly applied to this resource:

   gcloud org-policies describe \
     LIST_CONSTRAINT --organization=ORGANIZATION_ID
   

   Where:

   • ORGANIZATION_ID is a unique identifier for the organization resource. Organization ID is formatted as decimal numbers, and cannot have leading zeroes.

   • LIST_CONSTRAINT is the list constraint for the service that you want to enforce.

   You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively.

   The response will return the current organization policy, if one exists. For example:

   name: projects/841166443394/policies/gcp.resourceLocations
   spec:
     etag: BwW5P5cEOGs=
     inheritFromParent: true
     rules:
     - condition:
         expression: resource.matchTagId("tagKeys/1111", "tagValues/2222")
       values:
         allowedValues:
         - in:us-east1-locations
     - condition:
         expression: resource.matchTag("123/env", "prod")
       values:
         allowedValues:
         - in:us-west1-locations
     - values:
         deniedValues:
         - in:asia-south1-locations
     updateTime: '2021-01-19T12:00:51.095Z'
   

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

2. Set the policy on the organization using the set-policy command. This will overwrite any policy currently attached to the resource.

   1. Create a temporary file /tmp/policy.yaml to store the policy:

       name: organizations/ORGANIZATION_ID/policies/LIST_CONSTRAINT
       spec:
           rules:
             - values:
               deniedValues:
                 - VALUE_A
       

   2. Run the set-policy command:

       gcloud org-policies set-policy /tmp/policy.yaml
       

3. View the current effective policy using describe --effective. This returns the organization policy as it is evaluated at this point in the resource hierarchy with inheritance included.

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
     --organization=ORGANIZATION_ID
   

   The output of the command will be:

   name: organizations/ORGANIZATION_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - values:
           deniedValues:
           - VALUE_A
   

   Because this organization policy was set at the organization level, it will be inherited by all child resources that allow inheritance.

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Get the current policy on the organization resource using the describe command:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --organization ORGANIZATION_ID
   

   Where:

   • ORGANIZATION_ID is a unique identifier for the organization resource. Organization ID is formatted as decimal numbers, and cannot have leading zeroes.

   • LIST_CONSTRAINT is the list constraint for the service that you want to enforce.

   You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively.

   Because a policy isn't set, an incomplete policy is returned, like the following example:

   constraint: "constraints/LIST_CONSTRAINT"
   etag: BwVJi0OOESU=
   

2. Use the deny command to add the denied value for the service to which you want to restrict access.

   gcloud resource-manager org-policies deny \
     LIST_CONSTRAINT VALUE_A \
     --organization ORGANIZATION_ID
   

   The output of the command will be:

   constraint: constraints/LIST_CONSTRAINT
   etag: BwVJi0OOESU=
   listPolicy:
     deniedValues:
       - VALUE_A
   updateTime: CURRENT_TIME
   

3. View the current effective policy using describe --effective.

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
     --organization ORGANIZATION_ID
   

   The output of the command will be:

   constraint: constraints/LIST_CONSTRAINT
   listPolicy:
     deniedValues:
       - VALUE_A
   

   Because this organization policy was set at the organization level, it will be inherited by all child resources that allow inheritance.

Set up enforcement against a hierarchy subtree

List constraints take explicitly defined values to determine which resources should be allowed or denied. Some constraints can also accept values that use the prefix under:, which specifies a subtree with that resource as the root. Using the under: prefix on an allowed or denied value causes the organization policy to act on that resource and all of its children. For information about the constraints that allow using the under: prefix, see the Organization policy constraints page.

A value that uses the under: prefix is called a hierarchy subtree string. A hierarchy subtree string specifies the type of resource it applies to. For example, using a subtree string of projects/PROJECT_ID when setting the constraints/compute.storageResourceUseRestrictions constraint will allow or deny the use of Compute Engine storage for PROJECT_ID and all of its children.

Hierarchy subtree value prefixes are a beta feature, might be changed in backward-incompatible ways, and are not subject to any SLA or deprecation policy.

v2 API

1. Get the current policy on the organization resource using the describe command:

   gcloud org-policies describe \
     LIST_CONSTRAINT --organization=ORGANIZATION_ID
   

   Where:

   • ORGANIZATION_ID is a unique identifier for the organization resource.

   • LIST_CONSTRAINT is the list constraint for the service that you want to enforce.

   You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively.

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

2. Set the policy on the project using the set-policy command. The under: prefix sets the constraint to deny the named resource and all of its child resources.

   1. Create a temporary file /tmp/policy.yaml to store the policy:

       name: organizations/ORGANIZATION_ID/policies/LIST_CONSTRAINT
       spec:
           rules:
             - values:
                 deniedValues:
                   - under:folders/VALUE_A
       

   2. Run the set-policy command:

       gcloud org-policies set-policy /tmp/policy.yaml
       

   Where:

   • under: is a prefix that signifies what follows is a subtree string.

   • folders/VALUE_A is the folder ID of the root resource you want to deny. This resource and all of its children in the resource hierarchy will be denied.

   You can also apply the under: prefix to organizations and projects, as in the following examples:

   • under:organizations/VALUE_X

   • under:projects/VALUE_Y

3. View the current effective policy using describe --effective.

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
     --organization=ORGANIZATION_ID
   

   The output of the command will be:

   name: organizations/ORGANIZATION_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - values:
           deniedValues:
           - under:folders/VALUE_A
   

   The policy now evaluates to deny the folder VALUE_A and all of its child resources.

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Get the current policy on the organization resource using the describe command:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --organization ORGANIZATION_ID
   

   Where:

   • ORGANIZATION_ID is a unique identifier for the organization resource.

   • LIST_CONSTRAINT is the list constraint for the service that you want to enforce.

   You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively.

   Because a policy isn't set, an incomplete policy is returned, like the following example:

   constraint: "constraints/LIST_CONSTRAINT"
   etag: BwVJi0OOESU=
   

2. Use the deny command to add the denied value for the service to which you want to restrict access. The under: prefix sets the constraint to deny the named resource and all of its child resources.

   gcloud resource-manager org-policies deny \
     LIST_CONSTRAINT under:folders/VALUE_A \
     --organization ORGANIZATION_ID
   

   Where:

   • under: is a prefix that signifies what follows is a subtree string.

   • folders/VALUE_A is the folder ID of the root resource you want to deny. This resource and all of its children in the resource hierarchy will be denied.

   • VALUE_B and VALUE_C are projects that exist in the hierarchy with VALUE_A as their parent.

   The output of the deny command will be:

   constraint: constraints/LIST_CONSTRAINT
   etag: BwVJi0OOESU=
   listPolicy:
     deniedValues:
       - under:folders/VALUE_A
   updateTime: CURRENT_TIME
   

   You can also apply the under: prefix to organizations and projects, as in the following examples:

   • under:organizations/VALUE_X

   • under:projects/VALUE_Y

3. View the current effective policy using describe --effective.

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
     --organization ORGANIZATION_ID
   

   The output of the command will be:

   constraint: constraints/LIST_CONSTRAINT
   listPolicy:
     deniedValues:
       - under:folders/VALUE_A
   

   The policy now evaluates to deny the folder VALUE_A and all of its child resources, in this case VALUE_B and VALUE_C.

Merge the organization policy on a project

You can set a custom organization policy on a resource, which will merge with any policy inherited from its parent resource. This merged policy will then be evaluated to create a new effective policy based on the rules of inheritance.

v2 API

1. Get the current policy on the resource using the describe command:

   gcloud org-policies describe \
     LIST_CONSTRAINT --project=PROJECT_ID
   

   Where:

   • PROJECT_ID is the unique identifier of your project.

   • LIST_CONSTRAINT is the list constraint for the service that you want to enforce.

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

2. Display the current effective policy using the describe --effective command:

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
      --project=PROJECT_ID
   

   The output of the command will include a denied value that it inherits from the organization resource:

   name: projects/PROJECT_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - values:
           deniedValues:
             - VALUE_A
   

3. Set the policy on the project using the set-policy command.

   1. Create a temporary file /tmp/policy.yaml to store the policy:

       name: projects/PROJECT_ID/policies/LIST_CONSTRAINT
       spec:
           inheritFromParent: true
           rules:
             - values:
                 deniedValues:
                   - VALUE_B
                   - VALUE_C
       

   2. Run the set-policy command:

       gcloud org-policies set-policy /tmp/policy.yaml
       

4. Use the describe --effective command again to display the updated policy:

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
     --project=PROJECT_ID
   

   The output of the command will include the effective result of merging the policy from the resource and from the parent:

   name: projects/PROJECT_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - values:
           deniedValues:
             - VALUE_A
             - VALUE_B
             - VALUE_C
   

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Get the current policy on the resource using the describe command:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --project PROJECT_ID
   

   Where:

   • PROJECT_ID is the unique identifier of your project.

   • LIST_CONSTRAINT is the list constraint for the service that you want to enforce.

   Because a policy isn't set, an incomplete policy is returned, like the following example:

   constraint: "constraints/LIST_CONSTRAINT"
   etag: BwVJi0OOESU=
   

2. Display the current effective policy using the describe --effective command:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
      --project PROJECT_ID
   

   The output of the command will include a denied value that it inherits from the organization resource:

   constraint: constraints/LIST_CONSTRAINT
   listPolicy:
     deniedValues:
       - VALUE_A
   

3. Set the policy on the project using the set-policy command.

   1. Create a temporary file /tmp/policy.yaml to store the policy:

       constraint: constraints/LIST_CONSTRAINT
       listPolicy:
         deniedValues:
           - VALUE_B
           - VALUE_C
         inheritFromParent: true
       

   2. Run the set-policy command:

       gcloud resource-manager org-policies set-policy 
      
         --project PROJECT_ID /tmp/policy.yaml
       

   3. The output of the command will be:

       constraint: constraints/LIST_CONSTRAINT
       etag: BwVLO2timxY=
       listPolicy:
         deniedValues:
           - VALUE_B
           - VALUE_C
         inheritFromParent: true
       

4. Use the describe --effective command again to display the updated policy:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
     --project PROJECT_ID
   

   The output of the command will include the effective result of merging the policy from the resource and from the parent:

   constraint: constraints/LIST_CONSTRAINT
     listPolicy:
       deniedValues:
         - VALUE_A
         - VALUE_B
         - VALUE_C
   

Restore default constraint behavior

You can use the reset command to reset the policy to use the constraint's default behavior. For a list of all available constraints and their default values, see Organization policy constraints.The following example assumes that the default constraint behavior is to allow all values.

v2 API

1. Get the effective policy on the project to show the current merged policy:

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
     --project=PROJECT_ID
   

   Where PROJECT_ID is the unique identifier of your project. The output of the command will be:

   name: projects/PROJECT_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - values:
           deniedValues:
             - VALUE_A
             - VALUE_B
             - VALUE_C
   

2. Reset the organization policy using the reset command.

   gcloud org-policies reset LIST_CONSTRAINT \
       --project=PROJECT_ID
   

3. Get the effective policy to verify the default behavior:

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
     --project=PROJECT_ID
   

   The output of the command will allow all values:

   name: projects/PROJECT_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - allowAll: true
   

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Get the effective policy on the project to show the current merged policy:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
     --project PROJECT_ID
   

   Where PROJECT_ID is the unique identifier of your project. The output of the command will be:

   constraint: constraints/LIST_CONSTRAINT
     listPolicy:
       deniedValues:
         - VALUE_A
         - VALUE_B
         - VALUE_C
   

2. Set the policy on the project using the set-policy command.

   1. Create a temporary file /tmp/restore-policy.yaml to store the policy:

       restoreDefault: {}
       constraint: constraints/LIST_CONSTRAINT
       

   2. Run the set-policy command:

       gcloud resource-manager org-policies set-policy 
      
         --project PROJECT_ID /tmp/restore-policy.yaml
       

   3. The output of the command will be:

       constraint: constraints/LIST_CONSTRAINT
       etag: BwVJi9D3VLY=
       restoreDefault: {}
       

3. Get the effective policy to verify the default behavior:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
     --project PROJECT_ID
   

   The output of the command will allow all values:

   Constraint: constraints/LIST_CONSTRAINT
   listPolicy:
     allValues: ALLOW
   

Delete an organization policy

You can delete an organization policy from a resource. A resource without an organization policy set will inherit any policy of its parent resource. If you delete the organization policy on the organization resource, the effective policy will be the constraint's default behavior.

The following steps describe how to delete an organization policy on an organization.

v2 API

1. Delete the policy on the organization resource using the delete command:

   gcloud org-policies delete \
     LIST_CONSTRAINT --organization=ORGANIZATION_ID
   

   Where ORGANIZATION_ID is the unique identifier for the organization resource. The output of the command will be:

   Deleted policy
   [organizations/ORGANIZATION_ID/policies/LIST_CONSTRAINT].
   {}
   

2. Get the effective policy on the organization to verify it's not enforced:

   gcloud org-policies describe \
     LIST_CONSTRAINT --effective \
     --organization=ORGANIZATION_ID
   

   The output of the command will be:

   name: organizations/ORGANIZATION_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - allowAll: true
   

The following steps describe how to delete an organization policy on a project:

1. Delete the policy on a project using the delete command:

   gcloud org-policies delete \
     LIST_CONSTRAINT --project=PROJECT_ID
   

   Where PROJECT_ID is the unique identifier of your project. The output of the command will be:

   Deleted policy
   [projects/PROJECT_ID/policies/LIST_CONSTRAINT].
   {}
   

2. Get the effective policy on the project to verify it's not enforced:

   gcloud org-policies describe \
     --effective \
     LIST_CONSTRAINT --project=PROJECT_ID
   

   The output of the command will be:

   name: projects/PROJECT_ID/policies/LIST_CONSTRAINT
   spec:
     rules:
       - allowAll: true
   

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Delete the policy on the organization resource using the delete command:

   gcloud resource-manager org-policies delete \
     LIST_CONSTRAINT --organization ORGANIZATION_ID
   

   Where ORGANIZATION_ID is the unique identifier for the organization resource. The output of the command will be:

   Deleted [<Empty>].
   

2. Get the effective policy on the organization to verify it's not enforced:

   gcloud resource-manager org-policies describe \
     LIST_CONSTRAINT --effective \
     --organization ORGANIZATION_ID
   

   The output of the command will be:

   constraint: constraints/LIST_CONSTRAINT
   listPolicy:
     allValues: ALLOW
   

The following steps describe how to delete an organization policy on a project:

1. Delete the policy on a project using the delete command:

   gcloud resource-manager org-policies delete \
     LIST_CONSTRAINT --project PROJECT_ID
   

   Where PROJECT_ID is the unique identifier of your project. The output of the command will be:

   Deleted [<Empty>].
   

2. Get the effective policy on the project to verify it's not enforced:

   gcloud resource-manager org-policies describe \
     --effective \
     LIST_CONSTRAINT --project PROJECT_ID
   

   The output of the command will be:

   constraint: constraints/LIST_CONSTRAINT
   listPolicy:
     allValues: ALLOW
   

Using boolean constraints in organization policy

Set up enforcement on the organization resource

You can set an organization policy on your organization resource to enforce a boolean constraint. The following process describes how to set an organization policy using the gcloud command-line tool. For instructions on how to view and set organization policies using the Cloud Console, see Creating and Managing Policies.

v2 API

1. Get the current policy on the organization resource by using the describe command:

   gcloud org-policies describe \
     BOOLEAN_CONSTRAINT --organization=ORGANIZATION_ID
   

   Where ORGANIZATION_ID is the unique identifier for the organization resource. You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively.

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

2. Set the policy on the project using the set-policy command.

   1. Create a temporary file /tmp/policy.yaml to store the policy:

       name: organizations/ORGANIZATION_ID/policies/BOOLEAN_CONSTRAINT
       spec:
         rules:
           - enforce: true
       

   2. Run the set-policy command:

       gcloud org-policies set-policy /tmp/policy.yaml
       

3. View the current effective policy using describe --effective:

   gcloud org-policies describe \
     BOOLEAN_CONSTRAINT --effective \
     --organization=ORGANIZATION_ID
   

   The output of the command will be:

   name: organizations/ORGANIZATION_ID/policies/BOOLEAN_POLICY
   spec:
     rules:
       - enforce: true
   

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Get the current policy on the organization resource by using the describe command:

   gcloud resource-manager org-policies describe \
     BOOLEAN_CONSTRAINT --organization ORGANIZATION_ID
   

   Where ORGANIZATION_ID is the unique identifier for the organization resource. You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively.

   Because a policy isn't set, an incomplete policy is returned, like the following example:

   booleanPolicy: {}
   constraint: "constraints/BOOLEAN_CONSTRAINT"
   

2. Set the policy to enforce on the organization using the enable-enforce command:

   gcloud resource-manager org-policies enable-enforce \
     BOOLEAN_CONSTRAINT --organization ORGANIZATION_ID
   

   The output of the command will be:

   booleanPolicy:
     enforced: true
   constraint: constraints/BOOLEAN_CONSTRAINT
   etag: BwVJitxdiwY=
   

3. View the current effective policy using describe --effective:

   gcloud resource-manager org-policies describe \
     BOOLEAN_CONSTRAINT --effective \
     --organization ORGANIZATION_ID
   

   The output of the command will be:

   booleanPolicy:
     enforced: true
   constraint: constraints/BOOLEAN_CONSTRAINT
   

Override the organization policy for a project

To override the organization policy for a project, set a policy that disables enforcement of the boolean constraint to all resources in the hierarchy below the project.

v2 API

1. Get the current policy on the resource to show it's empty.

   gcloud org-policies describe \
     BOOLEAN_CONSTRAINT --project=PROJECT_ID
   

   Where PROJECT_ID is the unique identifier of your project. The output of the command will be:

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

2. Get the effective policy on the project, which confirms that the constraint is being enforced at this project.

   gcloud org-policies describe \
     BOOLEAN_CONSTRAINT --effective \
     --project=PROJECT_ID
   

   The output of the command will be:

   name: projects/PROJECT_ID/policies/BOOLEAN_POLICY
   spec:
     rules:
       - enforce: true
   

3. Set the policy on the project using the set-policy command.

   1. Create a temporary file /tmp/policy.yaml to store the policy:

       name: projects/PROJECT_ID/policies/BOOLEAN_CONSTRAINT
       spec:
         rules:
           - enforce: false
       

   2. Run the set-policy command:

       gcloud org-policies set-policy /tmp/policy.yaml
       

4. Get the effective policy to show that it is no longer enforced on the project.

   gcloud org-policies describe \
     --effective \
     BOOLEAN_CONSTRAINT --project=PROJECT_ID
   

   The output of the command will be:

   name: organizations/ORGANIZATION_ID/policies/BOOLEAN_POLICY
   spec:
     rules:
       - enforce: false
   

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Get the current policy on the resource to show it's empty.

   gcloud resource-manager org-policies describe \
     BOOLEAN_CONSTRAINT --project PROJECT_ID
   

   Where PROJECT_ID is the unique identifier of your project. The output of the command will be:

   booleanPolicy: {}
   constraint: "constraints/BOOLEAN_CONSTRAINT"
   

2. Get the effective policy on the project, which confirms that the constraint is being enforced at this project.

   gcloud resource-manager org-policies describe \
     BOOLEAN_CONSTRAINT --effective \
     --project PROJECT_ID
   

   The output of the command will be:

   booleanPolicy:
     enforced: true
   constraint: constraints/BOOLEAN_CONSTRAINT
   

3. Set the policy on the project to not enforce the constraint, using the disable-enforce command:

   gcloud resource-manager org-policies disable-enforce \
     BOOLEAN_CONSTRAINT --project PROJECT_ID
   

   The output of the command will be:

   booleanPolicy: {}
   constraint: constraints/BOOLEAN_CONSTRAINT
   etag: BwVJivdnXvM=
   

4. Get the effective policy to show that it is no longer enforced on the project.

   gcloud resource-manager org-policies describe \
     --effective \
     BOOLEAN_CONSTRAINT --project PROJECT_ID
   

   The output of the command will be:

   booleanPolicy: {}
   constraint: constraints/BOOLEAN_CONSTRAINT
   

Delete an organization policy

You can delete an organization policy from a resource. A resource without an organization policy set will inherit any policy of its parent resource. If you delete the organization policy on the organization resource, the effective policy will be the constraints' default behavior.

The following steps describe how to delete an organization policy on an organization and a project.

v2 API

1. Delete the policy from the organization resource using the delete command:

   gcloud org-policies delete \
     BOOLEAN_CONSTRAINT --organization=ORGANIZATION_ID
   

   Where ORGANIZATION_ID is a unique identifier for the organization resource. The output of the command will be:

   Deleted policy
   [organizations/ORGANIZATION_ID/policies/BOOLEAN_CONSTRAINT].
   {}
   

2. Get the effective policy on the organization to verify it's not enforced:

   gcloud org-policies describe \
     --effective \
     BOOLEAN_CONSTRAINT --organization=ORGANIZATION_ID
   

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

3. Delete the organization policy from the project using the delete command:

   gcloud org-policies delete \
     BOOLEAN_CONSTRAINT --project=PROJECT_ID
   

   The output of the command will be:

   Deleted policy
   [organizations/ORGANIZATION_ID/policies/BOOLEAN_CONSTRAINT].
   {}
   

4. Get the effective policy on the project to verify it's not enforced:

   gcloud org-policies describe \
     BOOLEAN_CONSTRAINT --effective \
     --project=PROJECT_ID
   

   Where the PROJECT_ID is the unique identifier of your project. The output of the command will be:

   If a policy isn't set, this will return a NOT_FOUND error:

   ERROR: (gcloud.org-policies.describe) NOT_FOUND: Requested entity was not found.
   

v1 API

Note: The Organization Policy v1 API does not work with tags or conditions. If you want to use this organization policy with Tags, see the v2 instructions.

1. Delete the policy from the organization resource using the delete command:

   gcloud resource-manager org-policies delete \
     BOOLEAN_CONSTRAINT --organization ORGANIZATION_ID
   

   Where ORGANIZATION_ID is a unique identifier for the organization resource. The output of the command will be:

   Deleted [<Empty>].
   

2. Get the effective policy on the organization to verify it's not enforced:

   gcloud resource-manager org-policies describe \
     --effective \
     BOOLEAN_CONSTRAINT --organization ORGANIZATION_ID
   

   The output of the command will be:

   booleanPolicy: {}
   constraint: constraints/BOOLEAN_CONSTRAINT
   

3. Delete the organization policy from the project using the delete command:

   gcloud resource-manager org-policies delete \
     BOOLEAN_CONSTRAINT --project PROJECT_ID
   

   The output of the command will be:

   Deleted [<Empty>].
   

4. Get the effective policy on the project to verify it's not enforced:

   gcloud resource-manager org-policies describe \
     BOOLEAN_CONSTRAINT --effective \
     --project PROJECT_ID
   

   Where the PROJECT_ID is the unique identifier of your project. The output of the command will be:

   booleanPolicy: {}
   constraint: constraints/BOOLEAN_CONSTRAINT