Organization policy constraints for Cloud Load Balancing

Organization Policy Service gives you centralized, programmatic control over your organization's resources. As the organization policy administrator, you can define an organization policy, which is a set of restrictions called constraints that apply to Google Cloud resources and descendants of those resources in the Google Cloud resource hierarchy.

This page provides supplemental information about organization policy constraints that apply to Cloud Load Balancing. You use organization policy constraints to enforce settings across an entire project, folder, or organization.

Organization policies only apply to new resources. Constraints are not enforced retroactively. If you have pre-existing load-balancing resources that are in violation of a new organization policy, you will need to address such violations manually.

Restrict load balancer types

Use an organization policy to restrict the Cloud Load Balancing types that can be created in your organization. Set the following organization policy constraint:

When you set the compute.restrictLoadBalancerCreationForTypes constraint, you specify an allowlist or denylist of the Cloud Load Balancing types. The list of allowed or denied values can only include values from the following list:

To include all internal or all external load balancer types, use the in: prefix followed by INTERNAL or EXTERNAL. For example, allowing in:INTERNAL allows all internal load balancers from the preceding list.

After you set the policy, the policy is enforced when adding the respective Google Cloud forwarding rules. The constraint is not enforced on existing Cloud Load Balancing configurations.

If you attempt to create a load balancer of a type that violates the constraint, the attempt fails and an error message is generated. The error message has the following format:

If you set multiple restrictLoadBalancerCreationForTypes constraints at different resource levels, they are enforced hierarchically. For this reason, we recommended that you set the inheritFromParent field to true, which ensures that policies at higher layers are also considered.

GKE error messages

If you are using Google Kubernetes Engine (GKE), and someone in your organization has created an organization policy that limits which types of load balancers can be created, then you'll see an error message similar to the following:

Depending on the policy, this might limit your ability to create new load balancer resources such as Services, Ingresses, or Gateways. Contact your organization policy administrators to help you understand which restrictions are in place.

Disable global load balancing

This legacy managed constraint disables creation of global load-balancing products. When enforced, only regional load-balancing products without global dependencies can be created.

Restrict the types of protocol forwarding deployments

Use an organization policy to restrict the types of protocol forwarding deployments (internal or external) that can be created in your organization. Set the following organization policy constraint:

To configure the compute.managed.restrictProtocolForwardingCreationForTypes constraint, you specify an allowlist or denylist of the type of protocol forwarding deployment to be allowed or denied. The list of allowed or denied values can only include the following values:

By default, newly created organizations have this policy configured to allow only INTERNAL protocol forwarding. That is, any forwarding rules associated with target instances are limited to using internal IP addresses only. If you want to use protocol forwarding with external IP addresses, or, if you want to prohibit users from using protocol forwarding with internal IP addresses, then you need to update this organization policy.

After you update the policy, the changes are enforced when you create any new forwarding rules associated with target instances. The constraint is not enforced retroactively on existing protocol forwarding configurations.

If you attempt to create a protocol forwarding deployment of a type that violates the constraint, the attempt fails and an error message is generated. The error message has the following format:

If you set multiple compute.managed.restrictProtocolForwardingCreationForTypes constraints at different resource levels, and if you set the inheritFromParent field to true, then the constraints are enforced hierarchically.

Enforce Shared VPC restrictions

Use the following organization policies to restrict how users are allowed to set up Shared VPC deployments.

Restrict Shared VPC host projects

This legacy managed constraint lets you restrict the Shared VPC host projects that a resource can attach to.

By default, a project can attach to any host project in the same organization, thereby becoming a service project. When you set the compute.restrictSharedVpcHostProjects constraint, you specify an allowlist or denylist of host projects in the following ways:

Restrict Shared VPC subnetworks

This legacy managed constraint defines the set of Shared VPC subnets that eligible resources can use. This constraint does not apply to resources within the same project.

By default, eligible resources can use any Shared VPC subnet. When you set the compute.restrictSharedVpcSubnetworks constraint, you specify a restricted list of subnets in the following ways:

Restrict cross-project backend buckets and backend services

You can use this constraint to limit the backend services and backend buckets that a URL map can reference. This constraint does not apply to backend services and backend buckets within the same project as the URL map.

By default, a URL map in one project can reference compatible backend services and backend buckets from other projects in the same organization as long as the user performing the action has the compute.backendServices.use, compute.regionBackendServices.use, or compute.backendBuckets.use permission.

To configure the restrictCrossProjectServices constraint, you can specify an allowlist or denylist of backend services or backend buckets in the following ways:

After you set up an organization policy with this constraint, the constraint goes into effect the next time you use the gcloud compute url-maps command to attach a backend service or a backend bucket to a URL map. The constraint does not retroactively affect existing references to any cross-project backend services or backend buckets.

This constraint applies to all deployment types, Shared VPC included. To avoid conflicts, we recommend not using both this constraint and the compute.restrictSharedVpcBackendServices constraint described in the next section.

Restrict Shared VPC backend services

You can use this constraint to limit the backend services that a URL map can reference in Shared VPC deployments that use cross-project service referencing. This constraint does not apply to backend services within the same project as the URL map.

We recommend using the compute.restrictCrossProjectServices constraint documented in the previous section instead. The compute.restrictCrossProjectServices constraint applies to all deployment types, Shared VPC or otherwise, and applies to both backend buckets and backend services.

Restrict Shared VPC project lien removal

This legacy managed constraint restricts the set of users that can remove a Shared VPC host project lien without organization-level permission where this constraint is already set to True.

By default, any user with the permission to update liens can remove a Shared VPC host project lien. Enforcing this constraint requires that permission be granted at the organization level.

Restrict TLS capabilities with custom constraints

To meet your compliance requirements and restrict certain Transport Layer Security (TLS) capabilities, you can create the following organization policy constraint and use it along with custom constraints for SSL policy resources:

By using the compute.requireSslPolicy constraint along with your own custom constraints for SSL policy fields, you can create restrictions tailored to your deployments. For example, you can do the following:

Use boolean rules in organization policies

Permissions required for this task

Set up list rules in organization policies

Permissions required for this task

To perform this task, you must have the following permissions:

Organization Policy Administrator role (roles/orgpolicy.policyAdmin). For more information, see Access control for organization resources with IAM.

Console

To set an organization policy from the console, complete the following steps:

In the Google Cloud console, go to the Organization policies page.
Go to Organization policies
In the Filter field, search for the constraint either by Name or by ID. For example, to restrict Shared VPC host projects, you search for the ID: constraints/compute.restrictSharedVpcHostProjects.
Click the name of the constraint.
Click Edit to edit the constraint.
To create a custom policy, select Customize and specify the allowlist or denylist of resources. For more detailed instructions about customizing organization policies by using the Google Cloud console, see Customizing policies for list constraints.
After making changes, click Save to apply the constraint settings.

gcloud

This section provides a few configuration examples to show you how to create and set an organization policy with a legacy managed constraint using list rules. For more detailed instructions about working with list rules and organization policies in gcloud, see Use list rules in organization policy.

Create the policy file. Use the following JSON configuration samples to create your own policy file based on your requirements.

Restrict load balancer types

Allow only a subset of load balancers

{
"constraint": "constraints/compute.restrictLoadBalancerCreationForTypes",
"listPolicy": {
  "allowedValues": [
    "INTERNAL_TCP_UDP",
    "EXTERNAL_NETWORK_TCP_UDP"
  ]
}
}

Deny all external load balancers

{
"constraint": "constraints/compute.restrictLoadBalancerCreationForTypes",
"listPolicy": {
  "deniedValues": [
    "in:EXTERNAL"
  ]
}
}

Deny all load balancers

{
"constraint": "constraints/compute.restrictLoadBalancerCreationForTypes",
"listPolicy": {
  "allValues": "DENY"
}
}

Restrict protocol forwarding types

Deny all protocol forwarding

{
"name": "RESOURCE_TYPE/RESOURCE_ID/policies/compute.managed.restrictProtocolForwardingCreationForTypes",
"spec": {
  "rules": [
    {
      "enforce": ["true"],
      "parameters": {
        "denyAll": "true"
      }
    }
  ]
}
}

Allow only internal protocol forwarding

{
"name": "RESOURCE_TYPE/RESOURCE_ID/policies/compute.managed.restrictProtocolForwardingCreationForTypes",
"spec": {
  "rules": [
    {
      "enforce": ["true"],
      "parameters": {
        "allowedSchemes": "EXTERNAL"
      }
    }
  ]
}
}

Restrict Shared VPC configurations

Restrict Shared VPC host projects

{
"constraint": "constraints/compute.restrictSharedVpcHostProjects",
"listPolicy": {
  "allowedValues": [
    "under:folders/FOLDER_ID",
    "under:projects/PROJECT_ID"
  ]
}
}

Restrict Shared VPC subnetworks

{
"constraint": "constraints/compute.restrictSharedVpcSubnetworks",
"listPolicy": {
  "deniedValues": [
    "under:organizations/ORGANIZATION_ID",
    "projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME"
  ]
}
}

Restrict Shared VPC backend services

{
"constraint": "constraints/compute.restrictCrossProjectServices",
"listPolicy": {
  "allowedValues": [
    "under:folders/FOLDER_ID",
    "under:projects/PROJECT_ID",
    "projects/PROJECT_ID/regions/REGION/backendServices/BACKEND_SERVICE_NAME"
  ]
}
}

Apply the constraint to a resource: either an organization, folder, or project.

For organizations, run the following command:
```
gcloud resource-manager org-policies set-policy POLICY_FILE \
    --organization=ORGANIZATION_ID
```
For folders, run the following command:
```
gcloud resource-manager org-policies set-policy POLICY_FILE \
    --folder=FOLDER_ID
```
For projects, run the following command:
```
gcloud resource-manager org-policies set-policy POLICY_FILE \
    --project=PROJECT_ID
```
Replace the following:
- POLICY_FILE: The full path to your organization policy YAML file.
- ORGANIZATION_ID: Your organization ID.
- FOLDER_ID: Your folder ID.
- PROJECT_ID: Your project ID.

Set up an organization policy to apply an SSL policy to target HTTPS proxies and target SSL proxies

Permissions required for this task

To perform this task, you must have the following permissions:

Organization Policy Administrator role (roles/orgpolicy.policyAdmin). For more information, see Access control for organization resources with IAM.

Console

To set an organization policy from the console, complete the following steps:

In the Google Cloud console, go to the Organization policies page.

Go to Organization policies
In the Filter field, search for the constraint either by Name or by ID.
Click the name of the constraint.
Click Edit to edit the constraint.
To create a custom policy, select Customize and specify the allowlist or denylist of resources.
After making changes, click Save to apply the constraint settings.

gcloud

This section provides a few configuration examples that show how to create and set an organization policy file with the compute.requireSslPolicy constraint.

Create a policy file to disallow SSL policy usage.

{
  "constraint": "constraints/compute.requireSslPolicy",
  "listPolicy": {
    "allValues": "DENY"
  }
}

Create a policy file to apply an SSL policy to all target HTTPS and SSL proxies under the specified resource in the resource hierarchy:

{
  "constraint": "constraints/compute.requireSslPolicy",
  "listPolicy": {
    "allowedValues": [
      "under:folders/FOLDER_ID",
      "under:projects/PROJECT_ID"
    ]
  }
}

Apply the constraint to target HTTPS and SSL proxies: either an organization, folder, or project.

For organizations, run the following command:
```
gcloud resource-manager org-policies set-policy PATH_TO_POLICY_FILE \
    --organization=ORGANIZATION_ID
```
For folders, run the following command:
```
gcloud resource-manager org-policies set-policy PATH_TO_POLICY_FILE \
    --folder=FOLDER_ID
```
For projects, run the following command:
```
gcloud resource-manager org-policies set-policy PATH_TO_POLICY_FILE \
    --project=PROJECT_ID
```
Replace the following:
- PATH_TO_POLICY_FILE: the path to your policy file
- ORGANIZATION_ID: your organization ID
- FOLDER_ID: your folder ID
- PROJECT_ID: your project ID

To get the effective policy to verify the default behavior of the resource (organization, folder, or project), run the following commands:

For organizations:

gcloud resource-manager org-policies describe compute.requireSslPolicy \
    --effective \
    --organization=ORGANIZATION_ID

For folders:

gcloud resource-manager org-policies describe compute.requireSslPolicy \
    --effective \
    --folder=FOLDER_ID

For projects:

gcloud resource-manager org-policies describe compute.requireSslPolicy \
    --effective \
    --project=PROJECT_ID

To delete the policy from the resource (organization, folder, or project), run the following commands:

For organizations:

gcloud resource-manager org-policies delete compute.requireSslPolicy \
    --organization=ORGANIZATION_ID

For folders:

gcloud resource-manager org-policies delete compute.requireSslPolicy \
    --folder=FOLDER_ID

For projects:

gcloud resource-manager org-policies delete compute.requireSslPolicy \
    --project=PROJECT_ID

To set up custom constraints, see Use custom constraints to restrict TLS capabilities.

What's next

To learn about the resource hierarchy that applies to organization policies, see Resource hierarchy.
For an overview of organization policies and constraints, see Introduction to the Organization Policy Service.
For instructions about working with constraints and organization policies in the Google Cloud console, see Introduction to the Organization Policy Service.
For instructions about working with constraints and organization policies in gcloud, see Using constraints.
For a complete list of available constraints, see Organization policy constraints.
For API methods relevant to organization policies, see the Cloud Resource Manager API reference documentation.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-06-09 UTC.

Organization policy constraints for Cloud Load Balancing Stay organized with collections Save and categorize content based on your preferences.

Restrict load balancer types

GKE error messages

Disable global load balancing

Restrict the types of protocol forwarding deployments

Enforce Shared VPC restrictions

Restrict Shared VPC host projects

Restrict Shared VPC subnetworks

Restrict cross-project backend buckets and backend services

Restrict Shared VPC backend services

Restrict Shared VPC project lien removal

Restrict TLS capabilities with custom constraints

Use boolean rules in organization policies

Permissions required for this task

Console

gcloud

Set up list rules in organization policies

Permissions required for this task

Console

gcloud

Set up an organization policy to apply an SSL policy to target HTTPS proxies and target SSL proxies

Permissions required for this task

Console

gcloud

What's next

Organization policy constraints for Cloud Load Balancing