Enforce organization policy by using Resource Manager

Create a project

1. Ensure that you have the Project Creator IAM role (roles/resourcemanager.projectCreator). Learn how to grant roles.

2. In the Google Cloud console, go to the project selector page.

   Go to project selector

3. Click Create project.

4. Name your project. Make a note of your generated project ID.

5. Edit the other fields as needed.

6. Click Create.

Create a Compute Engine disk

To test the functionality of the resource locations constraint, set up a Compute Engine regional persistent disk. When you create a regional persistent disk, you must specify the location where it will reside. For more information about creating Compute Engine regional persistent disks, see Create and manage regional disks.

1. In the Google Cloud console, go to the Disks page.

   Go to Disks

2. Select the project that you created.

   1. If you are prompted to link a billing account to your project, do so now. For more information about enabling billing, see Enable billing for a project.

3. Click Create disk.

4. Specify a Name for your disk.

5. For the Location, choose Regional.

6. For the Region, select europe-north1 (Finland).

7. For the Zone, select europe-north1-a.

8. Select the Replica zone in the same region.

9. Click Create.

When the disk is successfully created, a green check mark appears next to the name.

Set the organization policy

To set an organization policy on the project that you created:

1. In the Google Cloud console, go to the Organization policies page.

   Go to Organization policies

2. Click Select.

3. Select the project that you created.

4. Click Google Cloud Platform - Resource Location Restriction, and then click Manage policy.

5. Under Policy source, select Override parent's policy.

6. Under Policy enforcement, select Replace.

7. Click Add rule.

8. Under Policy values, select Custom.

9. Under Policy type, select Allow.

10. In the Custom values box, enter in:asia-locations.

11. Click Done, and then click Set policy. A notification appears to confirm the policy update.

asia-locations is a value group that is curated by Google to include every location in a particular geographic region. In this case, every region in Asia is defined as an allowed location for any resources created after this point. Note that the regional persistent disk you created is not affected by this new policy, because the policy is not retroactive.

Testing the organization policy

Now that the organization policy is in effect, you cannot create resources in regions that were not specified as part of the organization policy. To test this, try to create a regional persistent disk in an invalid location:

1. In the Google Cloud console, go to the Disks page.

   Go to Disks

2. Select the project that you created.

3. Click Create Disk.

4. Specify a Name for your disk.

5. For the Location, choose Regional.

6. For the Region, select europe-north1 (Finland).

7. For the Zone, select europe-north1-a.

8. Select the Replica zone in the same region.

9. Click Create.

A red exclamation point appears next to the name, and an error notification displays:

Location ZONE:europe-north1-a violates constraint
constraints/gcp.resourceLocations on the resource RESOURCE_ID

Where RESOURCE_ID is the full resource path of your project and disk. The disk is not created.

Create regional persistent disk in valid location

The organization policy constraint blocks the creation of resources unless you specify a valid location:

1. In the Google Cloud console, go to the Disks page.

   Go to Disks

2. Select the project that you created.

3. Click Create Disk.

4. Specify a Name for your disk.

5. For the Location, choose Regional.

6. For the Region, select asia-east2 (Hong Kong).

7. For the Zone, select asia-east2-a.

8. Select the Replica zone in the same region.

9. Click Create.

The resource is created successfully because all zones under asia-east2 are within the asia-locations value group.