This Terraform module makes it easier to manage organization policies for your Google Cloud environment, particularly when you want to have exclusion rules. This module will allow you to set a top-level org policy and then disable it on individual projects or folders easily.

This module is meant for use with Terraform 1.3+ and tested using Terraform 1.10+. If you find incompatibilities using Terraform >=1.3, please open an issue.

Many examples are included in the examples folder, but simple usage is as follows:

module "org-policy" { source = "terraform-google-modules/org-policy/google" version = "~> 7.0" policy_for = "organization" constraint = "constraints/serviceuser.services" policy_type = "list" organization_id = "123456789" enforce = true exclude_folders = ["folders/folder-1-id", "folders/folder-2-id"] exclude_projects = ["project3", "project4"] }

To control module's behavior, change variables' values regarding the following:

• constraint: set this variable with the constraint value in the form constraints/{constraint identifier}. For example, constraints/serviceuser.services
• policy_type: Specify either boolean for boolean policies or list for list policies. (default list)
• Policy Root: set one of the following values to determine where the policy is applied:
  • organization_id
  • project_id
  • folder_id
• policy_for: Specify the hierarchy level where the policy is applied. Can be one of the following values.
  • organization
  • folder
  • project
• exclude_folders: a list of folder IDs to be excluded from this policy. These folders must be lower in the hierarchy than the policy root.
• exclude_projects: a list of project IDs to be excluded from this policy. They must be lower in the hierarchy than the policy root.
• Boolean policies (with policy_type: "boolean") can set the following variables:
  • enforce: if true or null then the policy is enforced at the root; if false then policy is not enforced at the root. (default null)
• List policies (with policy_type: "list") can set one of the following variables. Only one may be set.
  • enforce: if true or null then policy will deny all; if false then policy will allow all (default null)
  • allow: list of values to include in the policy with ALLOW behavior. Set enforce to null to use it.
  • deny: list of values to include in the policy with DENY behavior. Set enforce to null to use it.
• List policies with allow or deny values require the length to be set (a workaround for this terraform issue)
  • allow_list_length
  • deny_list_length

[
 ""
]

[
 ""
]

No outputs.

• Terraform >= 1.3

In order to execute this module, the Service Account you run as must have the Organization Policy Administrator (roles/orgpolicy.PolicyAdmin) role.