Skip to main content
GCPReferenceintermediate

GCP Org Policy Reference

Browse and search GCP organization policy constraints with descriptions and examples.

CloudToolStack Team8 min readPublished Feb 22, 2026

Prerequisites

Search & Filters

20 constraints found
booleanCompute Engine

When enforced, this boolean constraint disables serial port access to Compute Engine VMs belonging to the organization, project, or folder where this constraint is active.

Default: Serial port access is allowed
booleanCompute Engine

When enforced, this boolean constraint enables OS Login on all newly created projects, preventing SSH key-based metadata from being set on Compute Engine instances.

Default: OS Login is not required
listCompute Engine

This list constraint defines the set of Shared VPC subnetworks that eligible resources can use. This constraint does not apply to resources in the same project as the host project.

Default: All Shared VPC subnetworks are allowed
listCompute Engine

This list constraint defines the set of Compute Engine VM instances that are allowed to use external IP addresses. By default, all VM instances are allowed to use external IP addresses.

Default: All VMs can have external IPs
booleanIAM

When enforced, this boolean constraint disables the creation of service account external keys. Service account keys are a security risk if not managed correctly.

Default: Service account key creation is allowed
listIAM

This list constraint defines the set of members that can be added to IAM policies. Only identities in the allowed domains can be added. This is commonly used to prevent sharing resources with external accounts.

Default: All identity domains are allowed
booleanCloud Storage

When enforced, this boolean constraint requires Cloud Storage buckets to use uniform bucket-level access, disabling object-level ACLs. This simplifies access management and improves security.

Default: Uniform bucket-level access is not required
booleanCloud SQL

When enforced, this boolean constraint restricts configuring public IPs on Cloud SQL instances. Public IP access to databases is a significant security risk and should be avoided in production.

Default: Public IP access is allowed on Cloud SQL
listCompute Engine

This list constraint defines the set of projects that can be used for image storage and disk instantiation for Compute Engine. Only images from trusted projects will be allowed.

Default: All image projects are allowed
listResource Manager

This list constraint defines the set of external organizations that resources can be exported or shared to. Controls data exfiltration by limiting where project resources can be moved.

Default: Export to any destination is allowed
listResource Manager

This list constraint defines the set of locations where location-based GCP resources can be created. Policies for this constraint can specify multi-regions, regions, or zones as allowed or denied locations.

Default: All locations are allowed
booleanCompute Engine

When enforced, this boolean constraint skips the creation of the default VPC network and related resources during Google Cloud project creation. The default network has overly permissive firewall rules.

Default: Default network is created in new projects
booleanIAM

When enforced, this boolean constraint disables the creation of service accounts in the organization, project, or folder. Use this to centralize service account management.

Default: Service account creation is allowed
booleanCompute Engine

When enforced, this boolean constraint requires that all new Compute Engine VM instances use Shielded VM images with Secure Boot, vTPM, and Integrity Monitoring enabled.

Default: Shielded VMs are not required
listCloud Functions

This list constraint defines the allowed ingress settings for deploying Cloud Functions. Use this to require internal-only or internal-and-gclb traffic sources.

Default: All ingress settings are allowed
booleanCompute Engine

When enforced, this boolean constraint disables hardware-accelerated nested virtualization for all Compute Engine VMs in the organization, project, or folder.

Default: Nested virtualization is allowed
booleanIAM

When enforced, this boolean constraint prevents the creation of new GKE clusters with Workload Identity disabled. All new clusters must use Workload Identity for secure pod-level access to Google Cloud APIs.

Default: Clusters can be created without Workload Identity
booleanCloud SQL

When enforced, this boolean constraint restricts adding authorized networks for unproxied database access to Cloud SQL instances. Use Cloud SQL Proxy or Private IP instead.

Default: Authorized networks can be configured
listCompute Engine

This list constraint defines the set of VPC networks that are allowed to be peered with the VPC networks belonging to this project, folder, or organization.

Default: VPC peering is allowed with any network
booleanCloud Storage

When enforced, this boolean constraint prevents Cloud Storage buckets from being made publicly accessible. This blocks allUsers and allAuthenticatedUsers from being granted access.

Default: Public access to buckets is allowed

Constraint JSON

Output will appear here...

Key Takeaways

  1. 1Organization policies enforce constraints regardless of IAM permissions.
  2. 2Boolean constraints enable or disable specific behaviors org-wide.
  3. 3List constraints allow or deny specific values like regions or VM types.
  4. 4Policies inherit down the resource hierarchy and can be overridden at lower levels.
  5. 5Use dry-run mode before enforcing new policies in production.

Frequently Asked Questions

What is the difference between IAM and organization policies in GCP?
IAM controls who can do what (authentication and authorization). Organization policies control what is allowed at all, regardless of permissions. Even an Organization Admin cannot violate an active org policy constraint.
Can organization policies be overridden at the project level?
By default, policies inherit from parent to child. However, you can configure policies to allow overrides at lower levels. Some constraints support merging (combining parent and child values) while others replace.
How do I find which organization policies are currently enforced?
Use 'gcloud resource-manager org-policies list --organization=ORG_ID' to see all active policies. The GCP Console also shows effective policies at each level of the resource hierarchy.
What happens if I enforce a policy that existing resources violate?
Existing resources are not automatically remediated. The policy only prevents new violations. Use the Policy Analyzer or dry-run mode to identify existing violations before enforcement.
Can I create custom organization policy constraints?
Yes, GCP supports custom constraints using Common Expression Language (CEL). Custom constraints can evaluate resource attributes during creation and updates, providing flexible governance beyond built-in constraints.

Written by CloudToolStack Team

Cloud engineers and architects with hands-on experience across AWS, Azure, and GCP. We write guides based on real-world production patterns, not just documentation rewrites.

Disclaimer: This guide is for educational purposes. Cloud services change frequently; always refer to official documentation for the latest information. AWS, Azure, and GCP are trademarks of their respective owners.