Test organization policy changes with Policy Simulator

Console

1. In the Google Cloud console, go to the Organization policies page.

   Go to Organization policies

2. From the organization selector, select your organization resource.

3. Do one of the following:

   • To test a new custom constraint, click add Custom constraint.

   • To make changes to an existing custom constraint, select it from the list on the Organization policies page, and then click edit Edit constraint.

4. Create or update the custom constraint you want to test.

   1. In the Display name box, enter a human-friendly name for the constraint. This field has a maximum length of 200 characters. Don't use PII or sensitive data in display names, because it could be exposed in error messages.

   2. In the Constraint ID box, enter the name you want for your new custom constraint. A custom constraint must start with custom., and can only include uppercase letters, lowercase letters, or numbers, for example, custom.disableGkeAutoUpgrade. The maximum length of this field is 70 characters, not counting the prefix, for example, organizations/123456789/customConstraints/custom.. Don't include PII or sensitive data in your constraint ID, because it could be exposed in error messages.

      The constraint ID can't be changed after a custom constraint is created.

   3. In the Description box, enter a human-friendly description of the constraint to display as an error message when the policy is violated. This field has a maximum length of 2000 characters. Don't include PII or sensitive data in your description, because it could be exposed in error messages.

   4. In the Resource type box, select the name of the Google Cloud REST resource containing the object and field you want to restrict—for example, container.googleapis.com/NodePool. Most resource types can have a maximum of 20 custom constraints per resource. If you try to create a custom constraint for a resource that already has the maximum number of custom constraints, the operation fails.

   5. In the Enforcement method section, select whether to enforce the constraint on a REST CREATE method, or on both CREATE and UPDATE methods. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.

   6. To define a condition, click edit Edit condition.

   7. In the Add condition panel, create a CEL condition that refers to a supported service resource, for example resource.management.autoUpgrade == false. This field has a maximum length of 1000 characters. For details about CEL usage, see Common Expression Language. For more information about the service resources you can use in your custom constraints, see Custom constraint supported services.

   8. Click Save.

   9. In the Action section, select whether to allow or deny the evaluated method if the condition you wrote is met.

      The deny action means that the operation to create or update the resource is blocked if the condition evaluates to true.

      The allow action means that the operation to create or update the resource is permitted only if the condition evaluates to true. Every other case except ones explicitly listed in the condition is blocked.

5. Click Test constraint.

6. If this is a new constraint, then the Configure organization policy pane appears. To define an organization policy that enforces the custom constraint, do the following:

   1. In the Select scope box, select the resource for which you want to test the custom constraint.

   2. Click Override parents' policy.

   3. Click Add a rule.

   4. In the Enforcement section, select On.

   5. Optionally, to make the organization policy conditional on a tag, click Add condition. If you add a conditional rule to an organization policy, you must add at least one unconditional rule or the policy cannot be saved. For more details, see Setting an organization policy with tags.

   6. Click Done, and then click Continue.

The Simulation history page appears, with a list of simulations performed by you in the last 14 days. See Policy Simulator results on this page for more information.

gcloud

1. To test enforcing a new or updated custom constraint, create a JSON or YAML file that defines the custom constraint you want to test.

   If you want to test changes to an existing custom constraint, you can use the organizations.customConstraints.get gcloud CLI command to retrieve the current JSON or YAML representation of the custom constraint, and then make edits to that file.

   A YAML file that defines a custom constraint looks similar to the following:

   name: organizations/ORGANIZATION_ID/customConstraints/CONSTRAINT_NAME
   resourceTypes:
   - RESOURCE_NAME
   methodTypes:
   - METHOD1
   - METHOD2
   condition: "CONDITION"
   actionType: ACTION
   displayName: DISPLAY_NAME
   description: DESCRIPTION
   

   Replace the following:

   • ORGANIZATION_ID: your organization ID, such as 123456789.

   • CONSTRAINT_NAME: the name you want for your new custom constraint. A custom constraint must start with custom., and can only include uppercase letters, lowercase letters, or numbers, for example, custom.disableGkeAutoUpgrade. The maximum length of this field is 70 characters, not counting the prefix, for example, organizations/123456789/customConstraints/custom..

   • RESOURCE_NAME: the fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, container.googleapis.com/NodePool. Most resource types can have a maximum of 20 custom constraints per resource. If you try to create a custom constraint for a resource that already has the maximum number of custom constraints, the operation fails. For more information about the service resources you can use in your custom constraints, see Custom constraint supported services.

   • METHOD1,METHOD2: a list of RESTful methods for which to enforce the constraint. Can be CREATE or CREATE and UPDATE. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.

   • CONDITION: a CEL condition that refers to a supported service resource, for example "resource.management.autoUpgrade == false". This field has a maximum length of 1000 characters. For details about CEL usage, see Common Expression Language.

   • ACTION: the action to take if the condition is met. This can be either ALLOW or DENY.

     • The deny action means that if the condition evaluates to true, the operation to create or update the resource is blocked.

     • The allow action means that if the condition evaluates to true, the operation to create or update the resource is permitted. This also means that every other case except the one explicitly listed in the condition is blocked.

   • DISPLAY_NAME: a human-friendly name for the constraint. This field has a maximum length of 200 characters.

   • DESCRIPTION: a human-friendly description of the constraint to display as an error message when the policy is violated. This field has a maximum length of 2000 For more information about how to create custom constraints, see Creating and managing custom constraints.

2. Create or modify an organization policy that enforces the custom constraint.

   • To test enforcing a new or updated custom constraint, create a JSON or YAML file that defines the organization policy you want to test:

     name: organizations/ORGANIZATION_ID/policies/CONSTRAINT_NAME
     spec:
       rules:
       - enforce: true
     

     Replace the following:

     • ORGANIZATION_ID with your organization ID, such as 1234567890123.

     • CONSTRAINT_NAME with the name of the custom constraint you want to test. For example, custom.EnforceGKEBinaryAuthz.

   • To test enforcing a custom constraint conditionally based on the existence of a particular tag, create a JSON or YAML file that defines the organization policy:

     name: organizations/ORGANIZATION_ID/policies/CONSTRAINT_NAME
     spec:
       rules:
       - condition:
           expression: CONDITION
         enforce: false
       - enforce: true
     

     Replace the following:

     • ORGANIZATION_ID with your organization ID, such as 1234567890123.

     • CONSTRAINT_NAME with the name of the custom constraint you want to test. For example, custom.EnforceGKEBinaryAuthz.

     • CONDITION with a CEL condition that refers to a supported service resource, for example "resource.matchTag('env', 'dev')".

     For more information about conditional organization policies, see Setting an organization policy with tags.

   • To test deleting an organization policy that enforces a custom constraint, create a JSON or YAML file that defines the organization policy with no rules set except for inheriting the policy from its parent resource:

     name: organizations/ORGANIZATION_ID/policies/CONSTRAINT_NAME
     spec:
       inheritFromParent: true
     

     Replace the following:

     • ORGANIZATION_ID with your organization ID, such as 1234567890123.

     • CONSTRAINT_NAME with the name of the custom constraint you want to test. For example, custom.EnforceGKEBinaryAuthz.

3. To simulate the change to a custom constraint, organization policy, or both, run the policy-intelligence simulate orgpolicy command:

   gcloud policy-intelligence simulate orgpolicy \
     --organization=ORGANIZATION_ID \
     --custom-constraints=CONSTRAINT_PATH \
     --policies=POLICY_PATH
   

   Replace the following:

   • ORGANIZATION_ID: your organization ID, such as 1234567890123. Simulating changes over multiple organizations is not supported.

   • CONSTRAINT_PATH: the full path to the custom constraint that you have created or updated. For example, tmp/constraint.yaml. If you set the --policies flag, you don't need to set the --custom-constraints flag.

   • POLICY_PATH: the full path to the organization policy you have created or updated. For example, tmp/policy.yaml If you set the --custom-constraints flag, you don't need to set the --policies flag.

After several minutes, the command prints a list of resources that would violate the changes to the custom constraint, the organization policy, or both.

Results are also viewable on the Simulation history page of the Google Cloud console. See Policy Simulator results on this page to learn how to read the results.

The following is a sample response for an organization policy simulation. This simulation involves a custom constraint that restricts the creation of Google Kubernetes Engine cluster resources where Binary Authorization is not enabled. In this case, if the proposed change were applied, two cluster resources would violate the policy: orgpolicy-test-cluster under the project simulator-test-project, and autopilot-cluster-1 under the project orgpolicy-test-0.

Waiting for operation [organizations/012345678901/locations/global/orgPolic
yViolationsPreviews/85be9a2d-8c49-470d-a65a-d0cb9ffa8f83/operations/1883a83
c-c448-42e5-a7c5-10a850928f06] to complete...done.
---
customConstraint:
  actionType: ALLOW
  condition: resource.binaryAuthorization.enabled == true
  methodTypes:
  - CREATE
  name: organizations/012345678901/customConstraints/custom.EnforceGKEBinaryAuthz
  resourceTypes:
  - container.googleapis.com/Cluster
name: organizations/012345678901/locations/global/orgPolicyViolationsPreviews/3dd47fd3-6df1-4156-8f10-413a3fc0ed83/orgPolicyViolations/b9fd23a5-7163-46de-9fec-7b9aa6af1113
resource:
  ancestors:
  - organizations/012345678901
  - projects/456789012345
  assetType: container.googleapis.com/Cluster
  resource: //container.googleapis.com/projects/simulator-test-project/locations/us-central1/clusters/orgpolicy-test-cluster
---
customConstraint:
  actionType: ALLOW