CODEWITHSUNDEEP
google-cloud-platformgoogle-iam
red888
red888

Reputation: 31652

Why did I have to "replace" instead of merge the org constraints/compute.vmExternalIpAccess for the override to work?

Docs I saw don't mention merge vs replace: https://cloud.google.com/compute/docs/ip-addresses/configure-static-external-ip-address#setorgpolicy

I'm trying to override the org policy in a project and only allow public IP for one server:

resource "google_project_organization_policy" "compute_vmExternalIpAccess" {
  project    = "myproject"
  constraint = "constraints/compute.vmExternalIpAccess"
  list_policy {
    inherit_from_parent = true # this doesn't work
    allow {
      values = [
        google_compute_instance.myserver.id
      ]
    }
  }
}

After doing this I still got an error when trying to apply a public IP to the instance.

It was only after I "replaced" instead of merged did it work (making inherit_from_parent false).

I was expecting it to inherit the deny all from the parent and I would override with just my exception. The parent has deny all, but what would have happened if the parent had its own allow list of specific VMs?

Upvotes: 0

Views: 26

Answers (0)

Related Questions