Resource: CustomConstraint
A custom constraint defined by customers which can only be applied to the given resource types and organization.
By creating a custom constraint, customers can apply policies of this custom constraint. Creating a custom constraint itself does NOT apply any policy enforcement.
JSON representation |
---|
{ "name": string, "resourceTypes": [ string ], "methodTypes": [ enum ( |
Fields | |
---|---|
name |
Immutable. Name of the constraint. This is unique within the organization. Format of the name should be
Example: The max length is 70 characters and the minimum length is 1. Note that the prefix |
resource |
Immutable. The resource instance type on which this policy applies. Format will be of the form :
|
method |
All the operations being applied for this constraint. |
condition |
Org policy condition/expression. For example: The max length of the condition is 1000 characters. |
action |
Allow or deny type. |
display |
One line display name for the UI. The max length of the displayName is 200 characters. |
description |
Detailed information about this custom policy constraint. The max length of the description is 2000 characters. |
update |
Output only. The last time this custom constraint was updated. This represents the last time that the A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
MethodType
The operation for which this constraint will be applied. To apply this constraint only when creating new VMs, the methodTypes
should be CREATE
only. To apply this constraint when creating or deleting VMs, the methodTypes
should be CREATE
and DELETE
.
UPDATE
only custom constraints are not supported. Use CREATE
or CREATE, UPDATE
.
Enums | |
---|---|
METHOD_TYPE_UNSPECIFIED |
Unspecified. Results in an error. |
CREATE |
Constraint applied when creating the resource. |
UPDATE |
Constraint applied when updating the resource. |
DELETE |
Constraint applied when deleting the resource. Not supported yet. |
REMOVE_GRANT |
Constraint applied when removing an IAM grant. |
GOVERN_TAGS |
Constraint applied when enforcing forced tagging. |
ActionType
Allow or deny type.
Enums | |
---|---|
ACTION_TYPE_UNSPECIFIED |
Unspecified. Results in an error. |
ALLOW |
Allowed action type. |
DENY |
Deny action type. |
Methods |
|
---|---|
|
Creates a custom constraint. |
|
Deletes a custom constraint. |
|
Gets a custom constraint. |
|
Retrieves all of the custom constraints that exist on a particular organization resource. |
|
Updates a custom constraint. |