Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menjelaskan beberapa contoh umum tentang cara menggunakan pembatasan organisasi.
Membatasi akses hanya untuk organisasi Anda
Dalam contoh ini, Google Cloud administrator dan administrator proxy keluar dari
Organisasi A bekerja sama untuk membatasi karyawan agar hanya mengakses resource di
organisasiGoogle Cloud mereka.
Untuk membatasi akses hanya ke organisasi Anda, lakukan hal berikut:
Sebagai Google Cloud administrator, untuk mendapatkan Google Cloud ID organisasi
Organisasi A, gunakan perintah gcloud organizations list:
gcloud organizations list
Berikut adalah contoh output:
DISPLAY_NAME: Organization A
ID: 123456789
DIRECTORY_CUSTOMER_ID: a1b2c3d4
Sebagai administrator proxy keluar, setelah Anda mendapatkan ID organisasi dari administrator Google Cloud, buat representasi JSON untuk nilai header dalam format berikut:
Sebagai administrator proxy keluar, konfigurasikan proxy keluar sehingga header permintaan berikut dimasukkan dalam semua permintaan yang berasal dari perangkat terkelola di Organisasi A:
Membatasi akses ke organisasi Anda dan mengizinkan permintaan baca ke resource Cloud Storage
Dalam contoh ini, administrator Google Cloud dan administrator proxy keluar dari Organisasi A bekerja sama untuk membatasi karyawan agar hanya mengakses resource di organisasiGoogle Cloud mereka, kecuali untuk permintaan baca ke resource Cloud Storage.
Administrator mungkin ingin menghapus permintaan baca ke resource Cloud Storage dari penerapan pembatasan organisasi untuk memastikan bahwa karyawan mereka dapat mengakses situs eksternal yang menggunakan Cloud Storage untuk menghosting konten statis. Administrator
menggunakan opsi cloudStorageReadAllowed untuk mengizinkan permintaan baca ke resource Cloud Storage.
Untuk membatasi akses hanya ke organisasi Anda dan mengizinkan permintaan baca ke resource Cloud Storage, lakukan tindakan berikut:
Sebagai Google Cloud administrator, untuk mendapatkan Google Cloud ID organisasi
Organisasi A, gunakan perintah gcloud organizations list:
gcloud organizations list
Berikut adalah contoh output:
DISPLAY_NAME: Organization A
ID: 123456789
DIRECTORY_CUSTOMER_ID: a1b2c3d4
Sebagai administrator proxy keluar, setelah Anda mendapatkan ID organisasi dari administrator Google Cloud, buat representasi JSON untuk nilai header dalam format berikut:
Sebagai administrator proxy keluar, konfigurasikan proxy keluar sehingga header permintaan berikut dimasukkan dalam semua permintaan yang berasal dari perangkat terkelola di Organisasi A:
Karyawan Organisasi A kini memiliki akses ke Google Cloud organisasi mereka
dan akses baca ke resource Cloud Storage.
Mengizinkan karyawan mengakses organisasi Google Cloud vendor
Dalam contoh ini, administrator Google Cloud dan administrator proxy keluar dari Organisasi B
bekerja sama untuk mengizinkan karyawan mengakses organisasi Google Cloud vendor
selain organisasi Google Cloud yang ada.
Untuk membatasi akses karyawan hanya ke organisasi Anda dan organisasi vendor, lakukan hal berikut:
Sebagai Google Cloud administrator, hubungi vendor untuk mendapatkan Google Cloud
ID organisasi organisasi vendor.
Sebagai administrator proxy keluar, untuk menyertakan ID organisasi vendor selain
ID organisasi yang ada, Anda harus memperbarui representasi JSON untuk
nilai header. Setelah Anda mendapatkan ID organisasi vendor dari administrator Google Cloud, perbarui nilai header dalam format berikut:
Sebagai administrator proxy keluar, konfigurasikan proxy keluar sehingga header permintaan berikut dimasukkan dalam semua permintaan yang berasal dari perangkat terkelola di Organisasi B:
Karyawan Organisasi B kini memiliki akses ke vendor dan Google Cloud organisasi mereka.
Membatasi akses hanya untuk upload
Dalam contoh ini, Google Cloud administrator dan administrator proxy keluar dari
Organisasi C bekerja sama untuk membatasi akses upload karyawan hanya ke resource di
organisasiGoogle Cloud .
Untuk membatasi akses upload hanya ke organisasi Anda, lakukan hal berikut:
Sebagai Google Cloud administrator, untuk mendapatkan Google Cloud ID organisasi
Organisasi C, gunakan perintah gcloud organizations list:
gcloud organizations list
Berikut adalah contoh output:
DISPLAY_NAME: Organization C
ID: 123456789
DIRECTORY_CUSTOMER_ID: a1b2c3d4
Sebagai administrator proxy keluar, setelah Anda mendapatkan ID organisasi dari administrator Google Cloud, buat representasi JSON untuk nilai header dalam format berikut:
Sebagai administrator proxy keluar, konfigurasikan proxy keluar sehingga header permintaan berikut
dimasukkan hanya untuk permintaan dengan metode PUT, POST, dan PATCH
yang berasal dari perangkat terkelola di Organisasi C:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-10 UTC."],[],[],null,["# Examples of organization restrictions\n\nThis page describes several common examples of how to use organization restrictions.\n\nRestrict access only to your organization\n-----------------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization A engage together to restrict employees to only access resources in their\nGoogle Cloud organization.\n\nTo restrict access only to your organization, do the following:\n\n1. As a Google Cloud administrator, to get the Google Cloud organization ID of\n Organization A, use the [`gcloud organizations list` command](/sdk/gcloud/reference/organizations/list):\n\n gcloud organizations list\n\n The following is the example output: \n\n ```\n DISPLAY_NAME: Organization A\n ID: 123456789\n DIRECTORY_CUSTOMER_ID: a1b2c3d4\n ```\n2. As an egress proxy administrator, after you get the organization ID from the Google Cloud\n administrator, compose the JSON representation for the header value in the following format:\n\n {\n \"resources\": [\"organizations/123456789\"],\n \"options\": \"strict\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted in all of the requests originating from the managed devices\n in Organization A:\n\n X-Goog-Allowed-Resources: ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\nRestrict access to your organization and allow read requests to Cloud Storage resources\n---------------------------------------------------------------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization A engage together to restrict employees to only access resources in their\nGoogle Cloud organization, except for read requests to Cloud Storage resources.\nAdministrators might want to omit read requests to Cloud Storage resources from\norganization restrictions enforcement to ensure that their employees can access\nexternal websites that use Cloud Storage to host static content. The administrator\nuses the `cloudStorageReadAllowed` option to allow read requests to Cloud Storage resources.\n\nTo restrict access only to your organization and allow read requests to Cloud Storage\nresources, do the following:\n\n1. As a Google Cloud administrator, to get the Google Cloud organization ID of\n Organization A, use the [`gcloud organizations list` command](/sdk/gcloud/reference/organizations/list):\n\n gcloud organizations list\n\n The following is the example output: \n\n ```\n DISPLAY_NAME: Organization A\n ID: 123456789\n DIRECTORY_CUSTOMER_ID: a1b2c3d4\n ```\n2. As an egress proxy administrator, after you get the organization ID from the Google Cloud\n administrator, compose the JSON representation for the header value in the following format:\n\n {\n \"resources\": [\"organizations/123456789\"],\n \"options\": \"cloudStorageReadAllowed\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogICJyZXNvdXJjZXMiOiBbIm9yZ2FuaXphdGlvbnMvMTIzNDU2Nzg5Il0sCiAgIm9wdGlvbnMiOiAiY2xvdWRTdG9yYWdlUmVhZEFsbG93ZCIKfQo=l\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted in all of the requests originating from the managed devices\n in Organization A:\n\n X-Goog-Allowed-Resources: ewogICJyZXNvdXJjZXMiOiBbIm9yZ2FuaXphdGlvbnMvMTIzNDU2Nzg5Il0sCiAgIm9wdGlvbnMiOiAiY2xvdWRTdG9yYWdlUmVhZEFsbG93ZCIKfQo=l\n\n The employees of Organization A now have access to their Google Cloud organization\n and read access to Cloud Storage resources.\n\nAllow employees access to a vendor Google Cloud organization\n------------------------------------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization B engage together to allow employees to access a vendor Google Cloud organization\nin addition to their existing Google Cloud organization.\n\nTo restrict employee access only to your organization and the vendor organization, do the following:\n\n1. As a Google Cloud administrator, engage with the vendor to get the Google Cloud\n organization ID of the vendor organization.\n\n2. As an egress proxy administrator, to include the vendor organization ID in addition\n to the existing organization ID, you must update the JSON representation for\n the header value. After you get the vendor organization ID from the Google Cloud\n administrator, update the header value in the following format:\n\n {\n \"resources\": [\"organizations/1234\", \"organizations/3456\"],\n \"options\": \"strict\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiLCAib3JnYW5pemF0aW9ucy8xMDExMTIxMzE0Il0sCiAib3B0aW9ucyI6ICJzdHJpY3QiCn0K\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted in all of the requests originating from the managed devices\n in Organization B:\n\n X-Goog-Allowed-Resources: ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiLCAib3JnYW5pemF0aW9ucy8xMDExMTIxMzE0Il0sCiAib3B0aW9ucyI6ICJzdHJpY3QiCn0K\n\n The employees of Organization B now have access to both the vendor and their Google Cloud organizations.\n\nRestrict access only for uploads\n--------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization C engage together to restrict upload access of employees only to resources in the\nGoogle Cloud organization.\n\nTo restrict upload access only to your organization, do the following:\n\n1. As a Google Cloud administrator, to get the Google Cloud organization ID of\n Organization C, use the [`gcloud organizations list` command](/sdk/gcloud/reference/organizations/list):\n\n gcloud organizations list\n\n The following is the example output: \n\n ```\n DISPLAY_NAME: Organization C\n ID: 123456789\n DIRECTORY_CUSTOMER_ID: a1b2c3d4\n ```\n2. As an egress proxy administrator, after you get the organization ID from the Google Cloud\n administrator, compose the JSON representation for the header value in the following format:\n\n {\n \"resources\": [\"organizations/123456789\"],\n \"options\": \"strict\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted only for requests with PUT, POST, and PATCH methods\n originating from the managed devices in Organization C:\n\n X-Goog-Allowed-Resources: ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\nWhat's next\n-----------\n\n- Learn about the [services supported by organization restrictions](/resource-manager/docs/organization-restrictions/supported-services)."]]
