constraints

Creates, updates, deletes, gets or lists a constraints resource.

Overview

Name	constraints
Type	Resource
Id	google.orgpolicy.constraints

Fields

The following fields are returned by SELECT queries:

folders_constraints_list

Name	Datatype	Description
name	string	Immutable. The resource name of the constraint. Must be in one of the following forms: * projects/{project_number}/constraints/{constraint_name} * folders/{folder_number}/constraints/{constraint_name} * organizations/{organization_number}/constraints/{constraint_name} For example, "/projects/123/constraints/compute.disableSerialPortAccess".
booleanConstraint	object	Defines this constraint as being a boolean constraint. (id: GoogleCloudOrgpolicyV2ConstraintBooleanConstraint)
constraintDefault	string	The evaluation behavior of this constraint in the absence of a policy. (CONSTRAINT_DEFAULT_UNSPECIFIED, ALLOW, DENY)
description	string	Detailed description of what this constraint controls as well as how and where it is enforced. Mutable.
displayName	string	The human readable name. Mutable.
equivalentConstraint	string	Defines the equivalent constraint name, if it exists. Managed constraints can have an equivalent legacy managed constraint, and legacy managed constraints can have an equivalent managed constraint. For example, "constraints/iam.disableServiceAccountKeyUpload" is equivalent to "constraints/iam.managed.disableServiceAccountKeyUpload".
listConstraint	object	Defines this constraint as being a list constraint. (id: GoogleCloudOrgpolicyV2ConstraintListConstraint)
supportsDryRun	boolean	Shows if dry run is supported for this constraint or not.
supportsSimulation	boolean	Shows if simulation is supported for this constraint or not.

organizations_constraints_list

Name	Datatype	Description
name	string	Immutable. The resource name of the constraint. Must be in one of the following forms: * projects/{project_number}/constraints/{constraint_name} * folders/{folder_number}/constraints/{constraint_name} * organizations/{organization_number}/constraints/{constraint_name} For example, "/projects/123/constraints/compute.disableSerialPortAccess".
booleanConstraint	object	Defines this constraint as being a boolean constraint. (id: GoogleCloudOrgpolicyV2ConstraintBooleanConstraint)
constraintDefault	string	The evaluation behavior of this constraint in the absence of a policy. (CONSTRAINT_DEFAULT_UNSPECIFIED, ALLOW, DENY)
description	string	Detailed description of what this constraint controls as well as how and where it is enforced. Mutable.
displayName	string	The human readable name. Mutable.
equivalentConstraint	string	Defines the equivalent constraint name, if it exists. Managed constraints can have an equivalent legacy managed constraint, and legacy managed constraints can have an equivalent managed constraint. For example, "constraints/iam.disableServiceAccountKeyUpload" is equivalent to "constraints/iam.managed.disableServiceAccountKeyUpload".
listConstraint	object	Defines this constraint as being a list constraint. (id: GoogleCloudOrgpolicyV2ConstraintListConstraint)
supportsDryRun	boolean	Shows if dry run is supported for this constraint or not.
supportsSimulation	boolean	Shows if simulation is supported for this constraint or not.

projects_constraints_list

Name	Datatype	Description
name	string	Immutable. The resource name of the constraint. Must be in one of the following forms: * projects/{project_number}/constraints/{constraint_name} * folders/{folder_number}/constraints/{constraint_name} * organizations/{organization_number}/constraints/{constraint_name} For example, "/projects/123/constraints/compute.disableSerialPortAccess".
booleanConstraint	object	Defines this constraint as being a boolean constraint. (id: GoogleCloudOrgpolicyV2ConstraintBooleanConstraint)
constraintDefault	string	The evaluation behavior of this constraint in the absence of a policy. (CONSTRAINT_DEFAULT_UNSPECIFIED, ALLOW, DENY)
description	string	Detailed description of what this constraint controls as well as how and where it is enforced. Mutable.
displayName	string	The human readable name. Mutable.
equivalentConstraint	string	Defines the equivalent constraint name, if it exists. Managed constraints can have an equivalent legacy managed constraint, and legacy managed constraints can have an equivalent managed constraint. For example, "constraints/iam.disableServiceAccountKeyUpload" is equivalent to "constraints/iam.managed.disableServiceAccountKeyUpload".
listConstraint	object	Defines this constraint as being a list constraint. (id: GoogleCloudOrgpolicyV2ConstraintListConstraint)
supportsDryRun	boolean	Shows if dry run is supported for this constraint or not.
supportsSimulation	boolean	Shows if simulation is supported for this constraint or not.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
folders_constraints_list	select	foldersId	pageSize, pageToken	Lists constraints that could be applied on the specified resource.
organizations_constraints_list	select	organizationsId	pageSize, pageToken	Lists constraints that could be applied on the specified resource.
projects_constraints_list	select	projectsId	pageSize, pageToken	Lists constraints that could be applied on the specified resource.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
foldersId	string
organizationsId	string
projectsId	string
pageSize	integer (int32)
pageToken	string

SELECT examples

folders_constraints_list

Lists constraints that could be applied on the specified resource.

SELECT
name,
booleanConstraint,
constraintDefault,
description,
displayName,
equivalentConstraint,
listConstraint,
supportsDryRun,
supportsSimulation
FROM google.orgpolicy.constraints
WHERE foldersId = '{{ foldersId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
;

organizations_constraints_list

Lists constraints that could be applied on the specified resource.

SELECT
name,
booleanConstraint,
constraintDefault,
description,
displayName,
equivalentConstraint,
listConstraint,
supportsDryRun,
supportsSimulation
FROM google.orgpolicy.constraints
WHERE organizationsId = '{{ organizationsId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
;

projects_constraints_list

Lists constraints that could be applied on the specified resource.

SELECT
name,
booleanConstraint,
constraintDefault,
description,
displayName,
equivalentConstraint,
listConstraint,
supportsDryRun,
supportsSimulation
FROM google.orgpolicy.constraints
WHERE projectsId = '{{ projectsId }}' -- required
AND pageSize = '{{ pageSize }}'
AND pageToken = '{{ pageToken }}'
;