google_org_policy_custom_constraint

Custom constraints are created by administrators to provide more granular and customizable control over the specific fields that are restricted by your organization policies.

To get more information about CustomConstraint, see:

Example Usage - Org Policy Custom Constraint Basic

resource "google_org_policy_custom_constraint" "constraint" {

  name         = "custom.disableGkeAutoUpgrade"
  parent       = "organizations/123456789"

  action_type    = "ALLOW"
  condition      = "resource.management.autoUpgrade == false"
  method_types   = ["CREATE", "UPDATE"]
  resource_types = ["container.googleapis.com/NodePool"]
}

Example Usage - Org Policy Custom Constraint Full

resource "google_org_policy_custom_constraint" "constraint" {

  name         = "custom.disableGkeAutoUpgrade"
  parent       = "organizations/123456789"
  display_name = "Disable GKE auto upgrade"
  description  = "Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced."

  action_type    = "ALLOW"
  condition      = "resource.management.autoUpgrade == false"
  method_types   = ["CREATE", "UPDATE"]
  resource_types = ["container.googleapis.com/NodePool"]
}

resource "google_org_policy_policy" "bool" {

  name   = "organizations/123456789/policies/${google_org_policy_custom_constraint.constraint.name}"
  parent = "organizations/123456789"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

Argument Reference

The following arguments are supported:


Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

Timeouts

This resource provides the following Timeouts configuration options:

Import

CustomConstraint can be imported using any of these accepted formats:

In Terraform v1.5.0 and later, use an import block to import CustomConstraint using one of the formats above. For example:

import {
  id = "{{parent}}/customConstraints/{{name}}"
  to = google_org_policy_custom_constraint.default
}

When using the terraform import command, CustomConstraint can be imported using one of the formats above. For example:

$ terraform import google_org_policy_custom_constraint.default {{parent}}/customConstraints/{{name}}