Guides

ORGPOLICY

Suggest Edits
cloud.google.com
GCP documentation

orgpolicy.folders.constraints.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.folders.policies.create

valid {
    input.Body.alternate.launch == STRING
    input.Body.alternate.spec.etag == STRING
    input.Body.alternate.spec.inheritFromParent == BOOLEAN
    input.Body.alternate.spec.reset == BOOLEAN
    input.Body.alternate.spec.rules[_].allowAll == BOOLEAN
    input.Body.alternate.spec.rules[_].condition.description == STRING
    input.Body.alternate.spec.rules[_].condition.expression == STRING
    input.Body.alternate.spec.rules[_].condition.location == STRING
    input.Body.alternate.spec.rules[_].condition.title == STRING
    input.Body.alternate.spec.rules[_].denyAll == BOOLEAN
    input.Body.alternate.spec.rules[_].enforce == BOOLEAN
    input.Body.alternate.spec.rules[_].parameters.STRING == ANY
    input.Body.alternate.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.alternate.spec.rules[_].values.deniedValues[_] == STRING
    input.Body.dryRunSpec.etag == STRING
    input.Body.dryRunSpec.inheritFromParent == BOOLEAN
    input.Body.dryRunSpec.reset == BOOLEAN
    input.Body.dryRunSpec.rules[_].allowAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].condition.description == STRING
    input.Body.dryRunSpec.rules[_].condition.expression == STRING
    input.Body.dryRunSpec.rules[_].condition.location == STRING
    input.Body.dryRunSpec.rules[_].condition.title == STRING
    input.Body.dryRunSpec.rules[_].denyAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].enforce == BOOLEAN
    input.Body.dryRunSpec.rules[_].parameters.STRING == ANY
    input.Body.dryRunSpec.rules[_].values.allowedValues[_] == STRING
    input.Body.dryRunSpec.rules[_].values.deniedValues[_] == STRING
    input.Body.etag == STRING
    input.Body.name == STRING
    input.Body.spec.etag == STRING
    input.Body.spec.inheritFromParent == BOOLEAN
    input.Body.spec.reset == BOOLEAN
    input.Body.spec.rules[_].allowAll == BOOLEAN
    input.Body.spec.rules[_].condition.description == STRING
    input.Body.spec.rules[_].condition.expression == STRING
    input.Body.spec.rules[_].condition.location == STRING
    input.Body.spec.rules[_].condition.title == STRING
    input.Body.spec.rules[_].denyAll == BOOLEAN
    input.Body.spec.rules[_].enforce == BOOLEAN
    input.Body.spec.rules[_].parameters.STRING == ANY
    input.Body.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.spec.rules[_].values.deniedValues[_] == STRING
    input.ReqMap.parent == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.folders.policies.delete

valid {
    input.ReqMap.name == STRING
    input.Qs.etag == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.folders.policies.get

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.folders.policies.getEffectivePolicy

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.folders.policies.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.folders.policies.patch

valid {
    input.Body.alternate.launch == STRING
    input.Body.alternate.spec.etag == STRING
    input.Body.alternate.spec.inheritFromParent == BOOLEAN
    input.Body.alternate.spec.reset == BOOLEAN
    input.Body.alternate.spec.rules[_].allowAll == BOOLEAN
    input.Body.alternate.spec.rules[_].condition.description == STRING
    input.Body.alternate.spec.rules[_].condition.expression == STRING
    input.Body.alternate.spec.rules[_].condition.location == STRING
    input.Body.alternate.spec.rules[_].condition.title == STRING
    input.Body.alternate.spec.rules[_].denyAll == BOOLEAN
    input.Body.alternate.spec.rules[_].enforce == BOOLEAN
    input.Body.alternate.spec.rules[_].parameters.STRING == ANY
    input.Body.alternate.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.alternate.spec.rules[_].values.deniedValues[_] == STRING
    input.Body.dryRunSpec.etag == STRING
    input.Body.dryRunSpec.inheritFromParent == BOOLEAN
    input.Body.dryRunSpec.reset == BOOLEAN
    input.Body.dryRunSpec.rules[_].allowAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].condition.description == STRING
    input.Body.dryRunSpec.rules[_].condition.expression == STRING
    input.Body.dryRunSpec.rules[_].condition.location == STRING
    input.Body.dryRunSpec.rules[_].condition.title == STRING
    input.Body.dryRunSpec.rules[_].denyAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].enforce == BOOLEAN
    input.Body.dryRunSpec.rules[_].parameters.STRING == ANY
    input.Body.dryRunSpec.rules[_].values.allowedValues[_] == STRING
    input.Body.dryRunSpec.rules[_].values.deniedValues[_] == STRING
    input.Body.etag == STRING
    input.Body.name == STRING
    input.Body.spec.etag == STRING
    input.Body.spec.inheritFromParent == BOOLEAN
    input.Body.spec.reset == BOOLEAN
    input.Body.spec.rules[_].allowAll == BOOLEAN
    input.Body.spec.rules[_].condition.description == STRING
    input.Body.spec.rules[_].condition.expression == STRING
    input.Body.spec.rules[_].condition.location == STRING
    input.Body.spec.rules[_].condition.title == STRING
    input.Body.spec.rules[_].denyAll == BOOLEAN
    input.Body.spec.rules[_].enforce == BOOLEAN
    input.Body.spec.rules[_].parameters.STRING == ANY
    input.Body.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.spec.rules[_].values.deniedValues[_] == STRING
    input.ReqMap.name == STRING
    input.Qs.updateMask == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.constraints.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.customConstraints.create

enum_GoogleCloudOrgpolicyV2CustomConstraintActionType := [ "ACTION_TYPE_UNSPECIFIED", "ALLOW", "DENY" ]
enum_GoogleCloudOrgpolicyV2CustomConstraintMethodTypes := [ "METHOD_TYPE_UNSPECIFIED", "CREATE", "UPDATE", "DELETE", "REMOVE_GRANT", "GOVERN_TAGS" ]

valid {
    input.Body.actionType == enum_GoogleCloudOrgpolicyV2CustomConstraintActionType[_]
    input.Body.condition == STRING
    input.Body.description == STRING
    input.Body.displayName == STRING
    input.Body.methodTypes[_] == enum_GoogleCloudOrgpolicyV2CustomConstraintMethodTypes[_]
    input.Body.name == STRING
    input.Body.resourceTypes[_] == STRING
    input.ReqMap.parent == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.customConstraints.delete

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.customConstraints.get

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.customConstraints.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.customConstraints.patch

enum_GoogleCloudOrgpolicyV2CustomConstraintActionType := [ "ACTION_TYPE_UNSPECIFIED", "ALLOW", "DENY" ]
enum_GoogleCloudOrgpolicyV2CustomConstraintMethodTypes := [ "METHOD_TYPE_UNSPECIFIED", "CREATE", "UPDATE", "DELETE", "REMOVE_GRANT", "GOVERN_TAGS" ]

valid {
    input.Body.actionType == enum_GoogleCloudOrgpolicyV2CustomConstraintActionType[_]
    input.Body.condition == STRING
    input.Body.description == STRING
    input.Body.displayName == STRING
    input.Body.methodTypes[_] == enum_GoogleCloudOrgpolicyV2CustomConstraintMethodTypes[_]
    input.Body.name == STRING
    input.Body.resourceTypes[_] == STRING
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.policies.create

valid {
    input.Body.alternate.launch == STRING
    input.Body.alternate.spec.etag == STRING
    input.Body.alternate.spec.inheritFromParent == BOOLEAN
    input.Body.alternate.spec.reset == BOOLEAN
    input.Body.alternate.spec.rules[_].allowAll == BOOLEAN
    input.Body.alternate.spec.rules[_].condition.description == STRING
    input.Body.alternate.spec.rules[_].condition.expression == STRING
    input.Body.alternate.spec.rules[_].condition.location == STRING
    input.Body.alternate.spec.rules[_].condition.title == STRING
    input.Body.alternate.spec.rules[_].denyAll == BOOLEAN
    input.Body.alternate.spec.rules[_].enforce == BOOLEAN
    input.Body.alternate.spec.rules[_].parameters.STRING == ANY
    input.Body.alternate.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.alternate.spec.rules[_].values.deniedValues[_] == STRING
    input.Body.dryRunSpec.etag == STRING
    input.Body.dryRunSpec.inheritFromParent == BOOLEAN
    input.Body.dryRunSpec.reset == BOOLEAN
    input.Body.dryRunSpec.rules[_].allowAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].condition.description == STRING
    input.Body.dryRunSpec.rules[_].condition.expression == STRING
    input.Body.dryRunSpec.rules[_].condition.location == STRING
    input.Body.dryRunSpec.rules[_].condition.title == STRING
    input.Body.dryRunSpec.rules[_].denyAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].enforce == BOOLEAN
    input.Body.dryRunSpec.rules[_].parameters.STRING == ANY
    input.Body.dryRunSpec.rules[_].values.allowedValues[_] == STRING
    input.Body.dryRunSpec.rules[_].values.deniedValues[_] == STRING
    input.Body.etag == STRING
    input.Body.name == STRING
    input.Body.spec.etag == STRING
    input.Body.spec.inheritFromParent == BOOLEAN
    input.Body.spec.reset == BOOLEAN
    input.Body.spec.rules[_].allowAll == BOOLEAN
    input.Body.spec.rules[_].condition.description == STRING
    input.Body.spec.rules[_].condition.expression == STRING
    input.Body.spec.rules[_].condition.location == STRING
    input.Body.spec.rules[_].condition.title == STRING
    input.Body.spec.rules[_].denyAll == BOOLEAN
    input.Body.spec.rules[_].enforce == BOOLEAN
    input.Body.spec.rules[_].parameters.STRING == ANY
    input.Body.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.spec.rules[_].values.deniedValues[_] == STRING
    input.ReqMap.parent == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.policies.delete

valid {
    input.ReqMap.name == STRING
    input.Qs.etag == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.policies.get

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.policies.getEffectivePolicy

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.policies.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.organizations.policies.patch

valid {
    input.Body.alternate.launch == STRING
    input.Body.alternate.spec.etag == STRING
    input.Body.alternate.spec.inheritFromParent == BOOLEAN
    input.Body.alternate.spec.reset == BOOLEAN
    input.Body.alternate.spec.rules[_].allowAll == BOOLEAN
    input.Body.alternate.spec.rules[_].condition.description == STRING
    input.Body.alternate.spec.rules[_].condition.expression == STRING
    input.Body.alternate.spec.rules[_].condition.location == STRING
    input.Body.alternate.spec.rules[_].condition.title == STRING
    input.Body.alternate.spec.rules[_].denyAll == BOOLEAN
    input.Body.alternate.spec.rules[_].enforce == BOOLEAN
    input.Body.alternate.spec.rules[_].parameters.STRING == ANY
    input.Body.alternate.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.alternate.spec.rules[_].values.deniedValues[_] == STRING
    input.Body.dryRunSpec.etag == STRING
    input.Body.dryRunSpec.inheritFromParent == BOOLEAN
    input.Body.dryRunSpec.reset == BOOLEAN
    input.Body.dryRunSpec.rules[_].allowAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].condition.description == STRING
    input.Body.dryRunSpec.rules[_].condition.expression == STRING
    input.Body.dryRunSpec.rules[_].condition.location == STRING
    input.Body.dryRunSpec.rules[_].condition.title == STRING
    input.Body.dryRunSpec.rules[_].denyAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].enforce == BOOLEAN
    input.Body.dryRunSpec.rules[_].parameters.STRING == ANY
    input.Body.dryRunSpec.rules[_].values.allowedValues[_] == STRING
    input.Body.dryRunSpec.rules[_].values.deniedValues[_] == STRING
    input.Body.etag == STRING
    input.Body.name == STRING
    input.Body.spec.etag == STRING
    input.Body.spec.inheritFromParent == BOOLEAN
    input.Body.spec.reset == BOOLEAN
    input.Body.spec.rules[_].allowAll == BOOLEAN
    input.Body.spec.rules[_].condition.description == STRING
    input.Body.spec.rules[_].condition.expression == STRING
    input.Body.spec.rules[_].condition.location == STRING
    input.Body.spec.rules[_].condition.title == STRING
    input.Body.spec.rules[_].denyAll == BOOLEAN
    input.Body.spec.rules[_].enforce == BOOLEAN
    input.Body.spec.rules[_].parameters.STRING == ANY
    input.Body.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.spec.rules[_].values.deniedValues[_] == STRING
    input.ReqMap.name == STRING
    input.Qs.updateMask == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.constraints.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.policies.create

valid {
    input.Body.alternate.launch == STRING
    input.Body.alternate.spec.etag == STRING
    input.Body.alternate.spec.inheritFromParent == BOOLEAN
    input.Body.alternate.spec.reset == BOOLEAN
    input.Body.alternate.spec.rules[_].allowAll == BOOLEAN
    input.Body.alternate.spec.rules[_].condition.description == STRING
    input.Body.alternate.spec.rules[_].condition.expression == STRING
    input.Body.alternate.spec.rules[_].condition.location == STRING
    input.Body.alternate.spec.rules[_].condition.title == STRING
    input.Body.alternate.spec.rules[_].denyAll == BOOLEAN
    input.Body.alternate.spec.rules[_].enforce == BOOLEAN
    input.Body.alternate.spec.rules[_].parameters.STRING == ANY
    input.Body.alternate.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.alternate.spec.rules[_].values.deniedValues[_] == STRING
    input.Body.dryRunSpec.etag == STRING
    input.Body.dryRunSpec.inheritFromParent == BOOLEAN
    input.Body.dryRunSpec.reset == BOOLEAN
    input.Body.dryRunSpec.rules[_].allowAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].condition.description == STRING
    input.Body.dryRunSpec.rules[_].condition.expression == STRING
    input.Body.dryRunSpec.rules[_].condition.location == STRING
    input.Body.dryRunSpec.rules[_].condition.title == STRING
    input.Body.dryRunSpec.rules[_].denyAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].enforce == BOOLEAN
    input.Body.dryRunSpec.rules[_].parameters.STRING == ANY
    input.Body.dryRunSpec.rules[_].values.allowedValues[_] == STRING
    input.Body.dryRunSpec.rules[_].values.deniedValues[_] == STRING
    input.Body.etag == STRING
    input.Body.name == STRING
    input.Body.spec.etag == STRING
    input.Body.spec.inheritFromParent == BOOLEAN
    input.Body.spec.reset == BOOLEAN
    input.Body.spec.rules[_].allowAll == BOOLEAN
    input.Body.spec.rules[_].condition.description == STRING
    input.Body.spec.rules[_].condition.expression == STRING
    input.Body.spec.rules[_].condition.location == STRING
    input.Body.spec.rules[_].condition.title == STRING
    input.Body.spec.rules[_].denyAll == BOOLEAN
    input.Body.spec.rules[_].enforce == BOOLEAN
    input.Body.spec.rules[_].parameters.STRING == ANY
    input.Body.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.spec.rules[_].values.deniedValues[_] == STRING
    input.ReqMap.parent == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.policies.delete

valid {
    input.ReqMap.name == STRING
    input.Qs.etag == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.policies.get

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.policies.getEffectivePolicy

valid {
    input.ReqMap.name == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.policies.list

valid {
    input.ReqMap.parent == STRING
    input.Qs.pageSize == INTEGER
    input.Qs.pageToken == STRING
    input.ProviderMetadata.Region == STRING
}

orgpolicy.projects.policies.patch

valid {
    input.Body.alternate.launch == STRING
    input.Body.alternate.spec.etag == STRING
    input.Body.alternate.spec.inheritFromParent == BOOLEAN
    input.Body.alternate.spec.reset == BOOLEAN
    input.Body.alternate.spec.rules[_].allowAll == BOOLEAN
    input.Body.alternate.spec.rules[_].condition.description == STRING
    input.Body.alternate.spec.rules[_].condition.expression == STRING
    input.Body.alternate.spec.rules[_].condition.location == STRING
    input.Body.alternate.spec.rules[_].condition.title == STRING
    input.Body.alternate.spec.rules[_].denyAll == BOOLEAN
    input.Body.alternate.spec.rules[_].enforce == BOOLEAN
    input.Body.alternate.spec.rules[_].parameters.STRING == ANY
    input.Body.alternate.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.alternate.spec.rules[_].values.deniedValues[_] == STRING
    input.Body.dryRunSpec.etag == STRING
    input.Body.dryRunSpec.inheritFromParent == BOOLEAN
    input.Body.dryRunSpec.reset == BOOLEAN
    input.Body.dryRunSpec.rules[_].allowAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].condition.description == STRING
    input.Body.dryRunSpec.rules[_].condition.expression == STRING
    input.Body.dryRunSpec.rules[_].condition.location == STRING
    input.Body.dryRunSpec.rules[_].condition.title == STRING
    input.Body.dryRunSpec.rules[_].denyAll == BOOLEAN
    input.Body.dryRunSpec.rules[_].enforce == BOOLEAN
    input.Body.dryRunSpec.rules[_].parameters.STRING == ANY
    input.Body.dryRunSpec.rules[_].values.allowedValues[_] == STRING
    input.Body.dryRunSpec.rules[_].values.deniedValues[_] == STRING
    input.Body.etag == STRING
    input.Body.name == STRING
    input.Body.spec.etag == STRING
    input.Body.spec.inheritFromParent == BOOLEAN
    input.Body.spec.reset == BOOLEAN
    input.Body.spec.rules[_].allowAll == BOOLEAN
    input.Body.spec.rules[_].condition.description == STRING
    input.Body.spec.rules[_].condition.expression == STRING
    input.Body.spec.rules[_].condition.location == STRING
    input.Body.spec.rules[_].condition.title == STRING
    input.Body.spec.rules[_].denyAll == BOOLEAN
    input.Body.spec.rules[_].enforce == BOOLEAN
    input.Body.spec.rules[_].parameters.STRING == ANY
    input.Body.spec.rules[_].values.allowedValues[_] == STRING
    input.Body.spec.rules[_].values.deniedValues[_] == STRING
    input.ReqMap.name == STRING
    input.Qs.updateMask == STRING
    input.ProviderMetadata.Region == STRING
}

Updated 4 days ago