Unable to create an org policy to deny the creation of all external load balancers

[mountaincode2]

I want to create an org policy to deny the creation of all external load balancers:

I am referring to the following documentation:

https://cloud.google.com/load-balancing/docs/org-policy-constraints

• Deny all external load balancers

  {
  "constraint": "constraints/compute.restrictLoadBalancerCreationForTypes",
  "listPolicy": {
    "deniedValues": [
      "in:EXTERNAL"
    ]
  }
  }
  

The following is my workflow:

1. Created the following org policy in my project: constraints/compute.restrictLoadBalancerCreationForTypes using the instructions in the following: https://cloud.google.com/resource-manager/docs/organization-policy/creating-managing-policies#boolean_constraints

2. When i try to create a load balancer, i get the following, which is expected:

Constraint constraints/compute.restrictLoadBalancerCreationForTypes violated for projects/org-policy-12345. Forwarding Rule projects/xxxxxx/global/forwardingRules/frontend-5 of type GLOBAL_EXTERNAL_MANAGED_HTTP_HTTPS is not allowed.

But now i want to update this org policy to only deny creation of external load balancers:

3. In the “Organization Policies” page in the Google Cloud Console, i select the constraint constraints/compute.restrictLoadBalancerCreationForTypes from the list and clicked Manage Policy.

4. I then went to Add a rule > Add condition > Condition Editor, and entered the following, but i get an error:

What am i missing in my understanding please?

[mountaincode2]

Can someone please help with this.

Thank you for your time!

[kensan]

Hi @mountaincode2 ,

Welcome to Google Cloud Community!

Based on your provided document. The first step is to create a Policy File and use the JSON configuration sample to create a policy file based on your requirement.

To create a Policy file here is the guide:

1. Open Cloud shell terminal, then click on Open Editor.
   

   

2. Add a new file with an extension name json (.json).

3. On the file paste the configuration from the document.

4. Then, follow step 2 on the guide from the documentation.

I hope the above information is helpful.

[mountaincode2]

Hi @kensan

Thank you for your response.

I wanted to customize my org policy constraints/compute.restrictLoadBalancerCreationForTypes using the console.

I was doing the following, which was not working:

Under Manage Policy, I then went to Add a rule > Add condition > Condition Editor. I then added the condition that i added in my query.

In order to disallow the creation of only external load balancers, i had to do the following, and it worked:

Under Manage Policy, go to “Edit rule”

• In Policy values dropdown, select Custom.

• In Policy type dropdown, select Deny.

• In Add value, enter in:External.

• Click Done.

With this, i was able to create internal load balancers and not external load balancers.