Docs
Packagesgcp.orgpolicy.CustomConstraint
Explore with Pulumi AI
Import
CustomConstraint can be imported using any of these accepted formats
$ pulumi import gcp:orgpolicy/customConstraint:CustomConstraint default {{parent}}/customConstraints/{{name}}
Example Usage
Org Policy Custom Constraint Basic
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var constraint = new Gcp.OrgPolicy.CustomConstraint("constraint", new()
{
Parent = "organizations/123456789",
ActionType = "ALLOW",
Condition = "resource.management.autoUpgrade == false",
MethodTypes = new[]
{
"CREATE",
"UPDATE",
},
ResourceTypes = new[]
{
"container.googleapis.com/NodePool",
},
}, new CustomResourceOptions
{
Provider = google_beta,
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/orgpolicy"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := orgpolicy.NewCustomConstraint(ctx, "constraint", &orgpolicy.CustomConstraintArgs{
Parent: pulumi.String("organizations/123456789"),
ActionType: pulumi.String("ALLOW"),
Condition: pulumi.String("resource.management.autoUpgrade == false"),
MethodTypes: pulumi.StringArray{
pulumi.String("CREATE"),
pulumi.String("UPDATE"),
},
ResourceTypes: pulumi.StringArray{
pulumi.String("container.googleapis.com/NodePool"),
},
}, pulumi.Provider(google_beta))
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.orgpolicy.CustomConstraint;
import com.pulumi.gcp.orgpolicy.CustomConstraintArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var constraint = new CustomConstraint("constraint", CustomConstraintArgs.builder()
.parent("organizations/123456789")
.actionType("ALLOW")
.condition("resource.management.autoUpgrade == false")
.methodTypes(
"CREATE",
"UPDATE")
.resourceTypes("container.googleapis.com/NodePool")
.build(), CustomResourceOptions.builder()
.provider(google_beta)
.build());
}
}
import pulumi
import pulumi_gcp as gcp
constraint = gcp.orgpolicy.CustomConstraint("constraint",
parent="organizations/123456789",
action_type="ALLOW",
condition="resource.management.autoUpgrade == false",
method_types=[
"CREATE",
"UPDATE",
],
resource_types=["container.googleapis.com/NodePool"],
opts=pulumi.ResourceOptions(provider=google_beta))
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const constraint = new gcp.orgpolicy.CustomConstraint("constraint", {
parent: "organizations/123456789",
actionType: "ALLOW",
condition: "resource.management.autoUpgrade == false",
methodTypes: [
"CREATE",
"UPDATE",
],
resourceTypes: ["container.googleapis.com/NodePool"],
}, {
provider: google_beta,
});
resources:
constraint:
type: gcp:orgpolicy:CustomConstraint
properties:
parent: organizations/123456789
actionType: ALLOW
condition: resource.management.autoUpgrade == false
methodTypes:
- CREATE
- UPDATE
resourceTypes:
- container.googleapis.com/NodePool
options:
provider: ${["google-beta"]}
Org Policy Custom Constraint Full
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
return await Deployment.RunAsync(() =>
{
var constraint = new Gcp.OrgPolicy.CustomConstraint("constraint", new()
{
Parent = "organizations/123456789",
DisplayName = "Disable GKE auto upgrade",
Description = "Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced.",
ActionType = "ALLOW",
Condition = "resource.management.autoUpgrade == false",
MethodTypes = new[]
{
"CREATE",
"UPDATE",
},
ResourceTypes = new[]
{
"container.googleapis.com/NodePool",
},
}, new CustomResourceOptions
{
Provider = google_beta,
});
var @bool = new Gcp.OrgPolicy.Policy("bool", new()
{
Parent = "organizations/123456789",
Spec = new Gcp.OrgPolicy.Inputs.PolicySpecArgs
{
Rules = new[]
{
new Gcp.OrgPolicy.Inputs.PolicySpecRuleArgs
{
Enforce = "TRUE",
},
},
},
}, new CustomResourceOptions
{
Provider = google_beta,
});
});
package main
import (
"github.com/pulumi/pulumi-gcp/sdk/v6/go/gcp/orgpolicy"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := orgpolicy.NewCustomConstraint(ctx, "constraint", &orgpolicy.CustomConstraintArgs{
Parent: pulumi.String("organizations/123456789"),
DisplayName: pulumi.String("Disable GKE auto upgrade"),
Description: pulumi.String("Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced."),
ActionType: pulumi.String("ALLOW"),
Condition: pulumi.String("resource.management.autoUpgrade == false"),
MethodTypes: pulumi.StringArray{
pulumi.String("CREATE"),
pulumi.String("UPDATE"),
},
ResourceTypes: pulumi.StringArray{
pulumi.String("container.googleapis.com/NodePool"),
},
}, pulumi.Provider(google_beta))
if err != nil {
return err
}
_, err = orgpolicy.NewPolicy(ctx, "bool", &orgpolicy.PolicyArgs{
Parent: pulumi.String("organizations/123456789"),
Spec: &orgpolicy.PolicySpecArgs{
Rules: orgpolicy.PolicySpecRuleArray{
&orgpolicy.PolicySpecRuleArgs{
Enforce: pulumi.String("TRUE"),
},
},
},
}, pulumi.Provider(google_beta))
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.orgpolicy.CustomConstraint;
import com.pulumi.gcp.orgpolicy.CustomConstraintArgs;
import com.pulumi.gcp.orgpolicy.Policy;
import com.pulumi.gcp.orgpolicy.PolicyArgs;
import com.pulumi.gcp.orgpolicy.inputs.PolicySpecArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var constraint = new CustomConstraint("constraint", CustomConstraintArgs.builder()
.parent("organizations/123456789")
.displayName("Disable GKE auto upgrade")
.description("Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced.")
.actionType("ALLOW")
.condition("resource.management.autoUpgrade == false")
.methodTypes(
"CREATE",
"UPDATE")
.resourceTypes("container.googleapis.com/NodePool")
.build(), CustomResourceOptions.builder()
.provider(google_beta)
.build());
var bool = new Policy("bool", PolicyArgs.builder()
.parent("organizations/123456789")
.spec(PolicySpecArgs.builder()
.rules(PolicySpecRuleArgs.builder()
.enforce("TRUE")
.build())
.build())
.build(), CustomResourceOptions.builder()
.provider(google_beta)
.build());
}
}
import pulumi
import pulumi_gcp as gcp
constraint = gcp.orgpolicy.CustomConstraint("constraint",
parent="organizations/123456789",
display_name="Disable GKE auto upgrade",
description="Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced.",
action_type="ALLOW",
condition="resource.management.autoUpgrade == false",
method_types=[
"CREATE",
"UPDATE",
],
resource_types=["container.googleapis.com/NodePool"],
opts=pulumi.ResourceOptions(provider=google_beta))
bool = gcp.orgpolicy.Policy("bool",
parent="organizations/123456789",
spec=gcp.orgpolicy.PolicySpecArgs(
rules=[gcp.orgpolicy.PolicySpecRuleArgs(
enforce="TRUE",
)],
),
opts=pulumi.ResourceOptions(provider=google_beta))
import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
const constraint = new gcp.orgpolicy.CustomConstraint("constraint", {
parent: "organizations/123456789",
displayName: "Disable GKE auto upgrade",
description: "Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced.",
actionType: "ALLOW",
condition: "resource.management.autoUpgrade == false",
methodTypes: [
"CREATE",
"UPDATE",
],
resourceTypes: ["container.googleapis.com/NodePool"],
}, {
provider: google_beta,
});
const bool = new gcp.orgpolicy.Policy("bool", {
parent: "organizations/123456789",
spec: {
rules: [{
enforce: "TRUE",
}],
},
}, {
provider: google_beta,
});
resources:
constraint:
type: gcp:orgpolicy:CustomConstraint
properties:
parent: organizations/123456789
displayName: Disable GKE auto upgrade
description: Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced.
actionType: ALLOW
condition: resource.management.autoUpgrade == false
methodTypes:
- CREATE
- UPDATE
resourceTypes:
- container.googleapis.com/NodePool
options:
provider: ${["google-beta"]}
bool:
type: gcp:orgpolicy:Policy
properties:
parent: organizations/123456789
spec:
rules:
- enforce: TRUE
options:
provider: ${["google-beta"]}
Create CustomConstraint Resource
new CustomConstraint(name: string, args: CustomConstraintArgs, opts?: CustomResourceOptions);@overload
def CustomConstraint(resource_name: str,
opts: Optional[ResourceOptions] = None,
action_type: Optional[str] = None,
condition: Optional[str] = None,
description: Optional[str] = None,
display_name: Optional[str] = None,
method_types: Optional[Sequence[str]] = None,
name: Optional[str] = None,
parent: Optional[str] = None,
resource_types: Optional[Sequence[str]] = None)
@overload
def CustomConstraint(resource_name: str,
args: CustomConstraintArgs,
opts: Optional[ResourceOptions] = None)func NewCustomConstraint(ctx *Context, name string, args CustomConstraintArgs, opts ...ResourceOption) (*CustomConstraint, error)public CustomConstraint(string name, CustomConstraintArgs args, CustomResourceOptions? opts = null)
public CustomConstraint(String name, CustomConstraintArgs args)
public CustomConstraint(String name, CustomConstraintArgs args, CustomResourceOptions options)
type: gcp:orgpolicy:CustomConstraint
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CustomConstraintArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args CustomConstraintArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args CustomConstraintArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args CustomConstraintArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args CustomConstraintArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
CustomConstraint Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The CustomConstraint resource accepts the following input properties:
- Action
Type string The action to take if the condition is met. Possible values are:
ALLOW,DENY.- Condition string
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- Method
Types List<string> A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- Parent string
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- Resource
Types List<string> Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- Description string
A human-friendly description of the constraint to display as an error message when the policy is violated.
- Display
Name string A human-friendly name for the constraint.
- Name string
Immutable. The name of the custom constraint. This is unique within the organization.
- Action
Type string The action to take if the condition is met. Possible values are:
ALLOW,DENY.- Condition string
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- Method
Types []string A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- Parent string
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- Resource
Types []string Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- Description string
A human-friendly description of the constraint to display as an error message when the policy is violated.
- Display
Name string A human-friendly name for the constraint.
- Name string
Immutable. The name of the custom constraint. This is unique within the organization.
- action
Type String The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition String
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- method
Types List<String> A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- parent String
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource
Types List<String> Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- description String
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display
Name String A human-friendly name for the constraint.
- name String
Immutable. The name of the custom constraint. This is unique within the organization.
- action
Type string The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition string
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- method
Types string[] A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- parent string
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource
Types string[] Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- description string
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display
Name string A human-friendly name for the constraint.
- name string
Immutable. The name of the custom constraint. This is unique within the organization.
- action_
type str The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition str
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- method_
types Sequence[str] A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- parent str
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource_
types Sequence[str] Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- description str
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display_
name str A human-friendly name for the constraint.
- name str
Immutable. The name of the custom constraint. This is unique within the organization.
- action
Type String The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition String
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- method
Types List<String> A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- parent String
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource
Types List<String> Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- description String
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display
Name String A human-friendly name for the constraint.
- name String
Immutable. The name of the custom constraint. This is unique within the organization.
Outputs
All input properties are implicitly available as output properties. Additionally, the CustomConstraint resource produces the following output properties:
- Id string
The provider-assigned unique ID for this managed resource.
- Update
Time string Output only. The timestamp representing when the constraint was last updated.
- Id string
The provider-assigned unique ID for this managed resource.
- Update
Time string Output only. The timestamp representing when the constraint was last updated.
- id String
The provider-assigned unique ID for this managed resource.
- update
Time String Output only. The timestamp representing when the constraint was last updated.
- id string
The provider-assigned unique ID for this managed resource.
- update
Time string Output only. The timestamp representing when the constraint was last updated.
- id str
The provider-assigned unique ID for this managed resource.
- update_
time str Output only. The timestamp representing when the constraint was last updated.
- id String
The provider-assigned unique ID for this managed resource.
- update
Time String Output only. The timestamp representing when the constraint was last updated.
Look up Existing CustomConstraint Resource
Get an existing CustomConstraint resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: CustomConstraintState, opts?: CustomResourceOptions): CustomConstraint@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
action_type: Optional[str] = None,
condition: Optional[str] = None,
description: Optional[str] = None,
display_name: Optional[str] = None,
method_types: Optional[Sequence[str]] = None,
name: Optional[str] = None,
parent: Optional[str] = None,
resource_types: Optional[Sequence[str]] = None,
update_time: Optional[str] = None) -> CustomConstraintfunc GetCustomConstraint(ctx *Context, name string, id IDInput, state *CustomConstraintState, opts ...ResourceOption) (*CustomConstraint, error)public static CustomConstraint Get(string name, Input<string> id, CustomConstraintState? state, CustomResourceOptions? opts = null)public static CustomConstraint get(String name, Output<String> id, CustomConstraintState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Action
Type string The action to take if the condition is met. Possible values are:
ALLOW,DENY.- Condition string
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- Description string
A human-friendly description of the constraint to display as an error message when the policy is violated.
- Display
Name string A human-friendly name for the constraint.
- Method
Types List<string> A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- Name string
Immutable. The name of the custom constraint. This is unique within the organization.
- Parent string
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- Resource
Types List<string> Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- Update
Time string Output only. The timestamp representing when the constraint was last updated.
- Action
Type string The action to take if the condition is met. Possible values are:
ALLOW,DENY.- Condition string
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- Description string
A human-friendly description of the constraint to display as an error message when the policy is violated.
- Display
Name string A human-friendly name for the constraint.
- Method
Types []string A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- Name string
Immutable. The name of the custom constraint. This is unique within the organization.
- Parent string
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- Resource
Types []string Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- Update
Time string Output only. The timestamp representing when the constraint was last updated.
- action
Type String The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition String
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- description String
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display
Name String A human-friendly name for the constraint.
- method
Types List<String> A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- name String
Immutable. The name of the custom constraint. This is unique within the organization.
- parent String
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource
Types List<String> Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- update
Time String Output only. The timestamp representing when the constraint was last updated.
- action
Type string The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition string
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- description string
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display
Name string A human-friendly name for the constraint.
- method
Types string[] A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- name string
Immutable. The name of the custom constraint. This is unique within the organization.
- parent string
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource
Types string[] Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- update
Time string Output only. The timestamp representing when the constraint was last updated.
- action_
type str The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition str
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- description str
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display_
name str A human-friendly name for the constraint.
- method_
types Sequence[str] A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- name str
Immutable. The name of the custom constraint. This is unique within the organization.
- parent str
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource_
types Sequence[str] Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- update_
time str Output only. The timestamp representing when the constraint was last updated.
- action
Type String The action to take if the condition is met. Possible values are:
ALLOW,DENY.- condition String
A CEL condition that refers to a supported service resource, for example
resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.- description String
A human-friendly description of the constraint to display as an error message when the policy is violated.
- display
Name String A human-friendly name for the constraint.
- method
Types List<String> A list of RESTful methods for which to enforce the constraint. Can be
CREATE,UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.- name String
Immutable. The name of the custom constraint. This is unique within the organization.
- parent String
The parent of the resource, an organization. Format should be
organizations/{organization_id}.- resource
Types List<String> Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example,
container.googleapis.com/NodePool.- update
Time String Output only. The timestamp representing when the constraint was last updated.
Package Details
- Repository
- Google Cloud (GCP) Classic pulumi/pulumi-gcp
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
google-betaTerraform Provider.