pulumi-gcp-kotlin/com.pulumi.gcp.orgpolicy.kotlin/CustomConstraintArgs

CustomConstraintArgs

data class CustomConstraintArgs(val actionType: Output<String>? = null, val condition: Output<String>? = null, val description: Output<String>? = null, val displayName: Output<String>? = null, val methodTypes: Output<List<String>>? = null, val name: Output<String>? = null, val parent: Output<String>? = null, val resourceTypes: Output<List<String>>? = null) : ConvertibleToJava<CustomConstraintArgs>

Custom constraints are created by administrators to provide more granular and customizable control over the specific fields that are restricted by your organization policies. To get more information about CustomConstraint, see:

API documentation
How-to Guides

Example Usage

Org Policy Custom Constraint Basic

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.orgpolicy.CustomConstraint;
import com.pulumi.gcp.orgpolicy.CustomConstraintArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var constraint = new CustomConstraint("constraint", CustomConstraintArgs.builder()
            .actionType("ALLOW")
            .condition("resource.management.autoUpgrade == false")
            .methodTypes(
                "CREATE",
                "UPDATE")
            .parent("organizations/123456789")
            .resourceTypes("container.googleapis.com/NodePool")
            .build());
    }
}

Org Policy Custom Constraint Full

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.orgpolicy.CustomConstraint;
import com.pulumi.gcp.orgpolicy.CustomConstraintArgs;
import com.pulumi.gcp.orgpolicy.Policy;
import com.pulumi.gcp.orgpolicy.PolicyArgs;
import com.pulumi.gcp.orgpolicy.inputs.PolicySpecArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var constraint = new CustomConstraint("constraint", CustomConstraintArgs.builder()
            .actionType("ALLOW")
            .condition("resource.management.autoUpgrade == false")
            .description("Only allow GKE NodePool resource to be created or updated if AutoUpgrade is not enabled where this custom constraint is enforced.")
            .displayName("Disable GKE auto upgrade")
            .methodTypes(
                "CREATE",
                "UPDATE")
            .parent("organizations/123456789")
            .resourceTypes("container.googleapis.com/NodePool")
            .build());
        var bool = new Policy("bool", PolicyArgs.builder()
            .parent("organizations/123456789")
            .spec(PolicySpecArgs.builder()
                .rules(PolicySpecRuleArgs.builder()
                    .enforce("TRUE")
                    .build())
                .build())
            .build());
    }
}

Import

CustomConstraint can be imported using any of these accepted formats* {{parent}}/customConstraints/{{name}} In Terraform v1.5.0 and later, use an import block to import CustomConstraint using one of the formats above. For exampletf import { id = "{{parent}}/customConstraints/{{name}}" to = google_org_policy_custom_constraint.default }

$ pulumi import gcp:orgpolicy/customConstraint:CustomConstraint When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), CustomConstraint can be imported using one of the formats above. For example

$ pulumi import gcp:orgpolicy/customConstraint:CustomConstraint default {{parent}}/customConstraints/{{name}}

Constructors

CustomConstraintArgs

fun CustomConstraintArgs(actionType: Output<String>? = null, condition: Output<String>? = null, description: Output<String>? = null, displayName: Output<String>? = null, methodTypes: Output<List<String>>? = null, name: Output<String>? = null, parent: Output<String>? = null, resourceTypes: Output<List<String>>? = null)

Functions

toJava

open override fun toJava(): CustomConstraintArgs

Properties

actionType

val actionType: Output<String>? = null

The action to take if the condition is met. Possible values are: ALLOW, DENY.

condition

val condition: Output<String>? = null

A CEL condition that refers to a supported service resource, for example resource.management.autoUpgrade == false. For details about CEL usage, see Common Expression Language.

description

val description: Output<String>? = null

A human-friendly description of the constraint to display as an error message when the policy is violated.

displayName

val displayName: Output<String>? = null

A human-friendly name for the constraint.

methodTypes

val methodTypes: Output<List<String>>? = null

A list of RESTful methods for which to enforce the constraint. Can be CREATE, UPDATE, or both. Not all Google Cloud services support both methods. To see supported methods for each service, find the service in Supported services.

name

val name: Output<String>? = null

Immutable. The name of the custom constraint. This is unique within the organization.

parent

val parent: Output<String>? = null

The parent of the resource, an organization. Format should be organizations/{organization_id}.

resourceTypes

val resourceTypes: Output<List<String>>? = null

Immutable. The fully qualified name of the Google Cloud REST resource containing the object and field you want to restrict. For example, container.googleapis.com/NodePool.