Sebagian atau seluruh informasi di halaman ini mungkin tidak berlaku untuk Trusted Cloud dari S3NS. Lihat
Perbedaan dari Google Cloud untuk mengetahui detail selengkapnya.
Menerapkan kebijakan organisasi menggunakan Resource Manager
Sebelum memulai
-
Verify that billing is enabled for your Trusted Cloud project.
-
Enable the Compute Engine and Resource Manager APIs.
Enable the APIs
-
Make sure that you have the following role or roles on the organization:
Organization Policy > Organization Policy Administrator, Compute Engine > Compute Storage Admin
Check for the roles
-
In the Trusted Cloud console, go to the IAM page.
Go to IAM
-
Select the organization.
-
In the Principal column, find all rows that identify you or a group that
you're included in. To learn which groups you're included in, contact your
administrator.
-
For all rows that specify or include you, check the Role column to see whether
the list of roles includes the required roles.
Grant the roles
-
In the Trusted Cloud console, go to the IAM page.
Buka IAM
-
Pilih organisasi.
-
Klik person_add Berikan akses.
-
Di kolom Akun utama baru, masukkan ID pengguna Anda.
Biasanya, ini adalah ID untuk pengguna dalam workforce identity pool. Untuk mengetahui detailnya,
lihat
Merepresentasikan pengguna kumpulan tenaga kerja dalam kebijakan IAM, atau hubungi administrator Anda.
-
Di daftar Pilih peran, pilih peran.
-
Untuk memberikan peran tambahan, klik add Tambahkan
peran lain, lalu tambahkan setiap peran tambahan.
-
Klik Simpan.
Buat Project baru
Untuk membuat resource Project, ikuti langkah-langkah di bawah:
Untuk membuat project baru, lakukan langkah-langkah berikut:
-
Buka halaman Manage resources di konsol Trusted Cloud .
Buka Kelola Resource
Langkah-langkah selanjutnya akan muncul di konsol Trusted Cloud .
-
Pada daftar drop-down Pilih organisasi di bagian atas halaman, pilih resource organisasi tempat Anda ingin membuat project. Jika Anda adalah pengguna uji coba gratis, lewati
langkah ini karena daftar ini tidak muncul.
- Klik Buat Project.
-
Di jendela Project Baru yang muncul, masukkan nama project dan pilih akun penagihan yang berlaku. Nama project hanya boleh berisi huruf, angka, tanda kutip tunggal, tanda hubung, spasi, atau tanda seru, serta harus memiliki 4 hingga 30 karakter.
-
Masukkan resource folder atau organisasi induk di kotak Location. Resource tersebut
akan menjadi induk hierarkis dari project baru. Jika opsi No organization tersedia,
Anda dapat memilihnya untuk membuat project baru sebagai tingkat teratas dari hierarki resource-nya sendiri.
- Setelah selesai memasukkan detail project baru, klik Buat.
Setelah Anda membuat Project, peran Owner akan ditetapkan kepada Anda.
Peran ini mencakup semua izin yang Anda perlukan untuk quickstart berikut.
Untuk mengetahui informasi selengkapnya tentang izin, lihat artikel Memberikan, mengubah, dan mencabut akses ke resource.
Membuat disk Compute Engine
Untuk menguji fungsi batasan lokasi resource, siapkan persistent disk regional Compute Engine. Saat membuat persistent disk regional, Anda harus menentukan lokasi tempat disk tersebut akan berada. Untuk mengetahui informasi selengkapnya tentang cara membuat persistent disk regional Compute Engine, lihat Membuat dan mengelola volume Persistent Disk regional.
Di konsol Trusted Cloud , buka halaman Disks.
Buka Disk
Pilih Project yang Anda buat sebelumnya.
- Jika Anda diminta untuk menautkan akun penagihan ke Project, lakukan sekarang.
Untuk mengetahui informasi selengkapnya tentang cara mengaktifkan penagihan, lihat
Mengubah Setelan Penagihan Project.
Klik Buat Disk.
Tentukan Nama untuk disk Anda.
Pilih Replikasi disk ini dalam region.
Di bagian Region, pilih europe-north1 (Finland).
Di bagian Zona, pilih europe-north1-a dan europe-north1-b.
Klik Buat.
Jika disk berhasil dibuat, tanda centang hijau akan muncul di samping
nama.
Menetapkan kebijakan organisasi
Untuk menetapkan kebijakan organisasi di Project yang Anda buat:
Di konsol Trusted Cloud , buka halaman Kebijakan organisasi.
Buka Organization policies
Klik Pilih.
Pilih Project yang Anda buat.
Klik Google Cloud Platform - Define Resource Locations, lalu
klik Edit.
Di bagian Berlaku untuk, pilih Sesuaikan.
Di bagian Policy values, pilih Custom.
Di bagian Policy values, pilih Allow.
Di kotak Nilai kebijakan, masukkan in:asia-locations.
Klik Simpan. Notifikasi akan muncul untuk mengonfirmasi pembaruan kebijakan.
asia-locations adalah grup nilai yang dikurasi oleh Google untuk menyertakan setiap lokasi di wilayah geografis tertentu.
Dalam hal ini, setiap region di Asia ditentukan sebagai lokasi yang diizinkan untuk semua
resource yang dibuat setelah titik ini. Perhatikan bahwa disk persisten regional yang Anda buat di atas tidak terpengaruh oleh kebijakan baru ini, karena kebijakan ini tidak berlaku surut.
Menguji kebijakan organisasi
Setelah kebijakan organisasi berlaku, Anda tidak dapat membuat resource di
region yang tidak ditentukan sebagai bagian dari kebijakan organisasi. Untuk mengujinya, coba buat persistent disk regional di lokasi yang tidak valid:
Di konsol Trusted Cloud , buka halaman Disks.
Buka Disk
Pilih Project yang Anda buat di atas.
Klik Buat Disk.
Tentukan Nama untuk disk Anda.
Pilih Replikasi disk ini dalam region.
Di bagian Region, pilih europe-north1 (Finland).
Di bagian Zona, pilih europe-north1-a dan europe-north1-b.
Klik Buat.
Tanda seru merah akan muncul di samping nama, dan notifikasi error akan ditampilkan:
Location ZONE:europe-north1-a violates constraint
constraints/gcp.resourceLocations on the resource RESOURCE_ID
Dengan RESOURCE_ID adalah jalur resource lengkap Project dan disk Anda.
Disk tidak dibuat.
Membuat persistent disk regional di lokasi yang valid
Batasan kebijakan organisasi memblokir pembuatan resource kecuali jika Anda
menentukan lokasi yang valid:
Di konsol Trusted Cloud , buka halaman Disks.
Buka Disk
Pilih Project yang Anda buat sebelumnya.
Klik Buat Disk.
Tentukan Nama untuk disk Anda.
Pilih Replikasi disk ini dalam region.
Di bagian Region, pilih asia-east2 (Hong Kong).
Di bagian Zona, pilih asia-east2-a dan asia-east2-b.
Klik Buat.
Resource berhasil dibuat karena semua zona di asia-east2 berada dalam grup nilai asia-locations.
Pembersihan
Agar akun Trusted Cloud Anda tidak dikenai biaya untuk
resource yang digunakan pada halaman ini, ikuti langkah-langkah berikut.
Menghapus persistent disk regional
Hapus persistent disk regional yang Anda buat untuk panduan memulai ini:
Di konsol Trusted Cloud , buka halaman Disks.
Buka Disk
Dalam daftar yang muncul, pilih kedua disk yang Anda buat.
Di sebelah kanan tombol Buat Disk, klik Hapus.
Pada dialog konfirmasi yang muncul, klik Hapus.
Dialog notifikasi akan muncul untuk mengonfirmasi bahwa disk telah dihapus.
Menghapus Project
Hapus Project yang Anda buat untuk panduan memulai ini:
Di konsol Trusted Cloud , buka halaman Kelola resource.
Buka Kelola resource
Di menu drop-down di bagian atas halaman, pilih Organisasi tempat Anda membuat Project panduan memulai.
Dalam daftar resource Project yang muncul, pilih Project yang Anda buat, lalu klik Hapus.
Pada dialog Shut down project yang muncul, masukkan Project ID,
lalu klik Shut down.
Kecuali dinyatakan lain, konten di halaman ini dilisensikan berdasarkan Lisensi Creative Commons Attribution 4.0, sedangkan contoh kode dilisensikan berdasarkan Lisensi Apache 2.0. Untuk mengetahui informasi selengkapnya, lihat Kebijakan Situs Google Developers. Java adalah merek dagang terdaftar dari Oracle dan/atau afiliasinya.
Terakhir diperbarui pada 2025-08-18 UTC.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Quickstart: Enforce organization policy by using Resource Manager\n\nEnforce organization policy by using Resource Manager\n=====================================================\n\nThis guide describes how to set an [organization policy](/resource-manager/docs/organization-policy/overview) that\nincludes the [resource locations](/resource-manager/docs/organization-policy/defining-locations) constraint, and\nhow to test that constraint after it is applied in the\n[Google Cloud console](https://console.cloud.google.com/).\n\nBefore you begin\n----------------\n\n1.\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n2.\n\n\n Enable the Compute Engine and Resource Manager APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=compute.googleapis.com,cloudresourcemanager.googleapis.com&redirect=https://console.cloud.google.com)\n3.\n\n Make sure that you have the following role or roles on the organization:\n\n Organization Policy \\\u003e Organization Policy Administrator, Compute Engine \\\u003e Compute Storage Admin\n\n #### Check for the roles\n\n 1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=organizationId)\n 2. Select the organization.\n 3.\n In the **Principal** column, find all rows that identify you or a group that\n you're included in. To learn which groups you're included in, contact your\n administrator.\n\n 4. For all rows that specify or include you, check the **Role** column to see whether the list of roles includes the required roles.\n\n #### Grant the roles\n\n 1.\n In the Google Cloud console, go to the **IAM** page.\n\n [Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=organizationId)\n 2. Select the organization.\n 3. Click person_add **Grant access**.\n 4.\n In the **New principals** field, enter your user identifier.\n\n This is typically the email address for a Google Account.\n\n 5. In the **Select a role** list, select a role.\n 6. To grant additional roles, click add **Add\n another role** and add each additional role.\n 7. Click **Save**.\n\nCreate new Project\n------------------\n\nTo create a Project resource, follow the steps below:\n\nTo create a new project, do the following:\n\n1. Go to the **Manage resources** page in the Google Cloud console.\n\n [Go to Manage Resources](https://console.cloud.google.com/cloud-resource-manager?walkthrough_id=resource-manager--create-project&start_index=1#step_index=1)\n\n The remaining steps appear in the Google Cloud console.\n2. On the **Select organization** drop-down list at the top of the page, select the organization resource in which you want to create a project. If you are a free trial user, skip this step, as this list does not appear.\n3. Click **Create Project**.\n4. In the **New Project** window that appears, enter a project name and select a billing account as applicable. A project name can contain only letters, numbers, single quotes, hyphens, spaces, or exclamation points, and must be between 4 and 30 characters.\n5. Enter the parent organization or folder resource in the **Location** box. That resource will be the hierarchical parent of the new project. If **No organization** is an option, you can select it to create your new project as the top level of its own resource hierarchy.\n6. When you're finished entering new project details, click **Create**.\n\nAfter you create the Project, the **Owner** role is assigned to you.\nThis role includes all of the permissions you need for the following quickstart.\nFor more information about permissions, see\n[Granting, changing, and revoking access to resources](/iam/docs/granting-changing-revoking-access).\n\nCreate a Compute Engine disk\n----------------------------\n\nTo test the functionality of the resource locations constraint, set up\nCompute Engine regional persistent disks. When you create a regional\npersistent disk, you must specify the location where it will reside. For more\ninformation about creating Compute Engine regional persistent disks, see\n[Create and manage regional Persistent Disk volumes](/compute/docs/disks/regional-persistent-disk).\n\n1. In the Google Cloud console, go to the **Disks** page.\n\n [Go to Disks](https://console.cloud.google.com/compute/disks)\n2. Select the Project you created previously.\n\n 1. If you are prompted to link a billing account to your Project, do so now. For more information about enabling billing, see [Modify a Project's Billing Settings](/billing/docs/how-to/modify-project#enable_billing_for_a_project).\n3. Click **Create Disk**.\n\n4. Specify a **Name** for your disk.\n\n5. Select **Replicate this disk within region**.\n\n6. Under **Region** , select `europe-north1 (Finland)`.\n\n7. Under **Zones** , select `europe-north1-a` and `europe-north1-b`.\n\n8. Click **Create**.\n\nWhen the disk is successfully created, a green check mark appears next to the\nname.\n\nSet the organization policy\n---------------------------\n\nTo set an organization policy on the Project you created:\n\n1. In the Google Cloud console, go to the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. Click **Select**.\n\n3. Select the Project you created.\n\n4. Click **Google Cloud Platform - Define Resource Locations** , and then\n click **Edit**.\n\n5. Under **Applies to** , select **Customize**.\n\n6. Under **Policy values** , select **Custom**.\n\n7. Under **Policy type** , select **Allow**.\n\n8. In the **Policy value** box, enter `in:asia-locations`.\n\n9. Click **Save**. A notification appears to confirm the policy update.\n\n`asia-locations` is a [value group](/resource-manager/docs/organization-policy/defining-locations#value_groups) that is\ncurated by Google to include every location in a particular geographic region.\nIn this case, every region in Asia is defined as an allowed location for any\nresources created after this point. Note that the regional persistent disk you\ncreated above is not affected by this new policy, because the policy is not\nretroactive.\n\nTesting the organization policy\n-------------------------------\n\nNow that the organization policy is in effect, you cannot create resources in\nregions that were not specified as part of the organization policy. To test\nthis, try to create a regional persistent disk in an invalid location:\n\n1. In the Google Cloud console, go to the **Disks** page.\n\n [Go to Disks](https://console.cloud.google.com/compute/disks)\n2. Select the Project you created above.\n\n3. Click **Create Disk**.\n\n4. Specify a **Name** for your disk.\n\n5. Select **Replicate this disk within region**.\n\n6. Under **Region** , select `europe-north1 (Finland)`.\n\n7. Under **Zones** , select `europe-north1-a` and `europe-north1-b`.\n\n8. Click **Create**.\n\nA red exclamation point appears next to the name, and an error notification\ndisplays: \n\n```\nLocation ZONE:europe-north1-a violates constraint\nconstraints/gcp.resourceLocations on the resource RESOURCE_ID\n```\n\nWhere \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e is the full resource path of your Project and disk.\nThe disk is not created.\n\nCreate regional persistent disk in valid location\n-------------------------------------------------\n\nThe organization policy constraint blocks the creation of resources unless you\nspecify a valid location:\n\n1. In the Google Cloud console, go to the **Disks** page.\n\n [Go to Disks](https://console.cloud.google.com/compute/disks)\n2. Select the Project you created previously.\n\n3. Click **Create Disk**.\n\n4. Specify a **Name** for your disk.\n\n5. Select **Replicate this disk within region**.\n\n6. Under **Region** , select `asia-east2 (Hong Kong)`.\n\n7. Under **Zones** , select `asia-east2-a` and `asia-east2-b`.\n\n8. Click **Create**.\n\nThe resource is created successfully because all zones under `asia-east2` are\nwithin the `asia-locations` value group.\n\nClean up\n--------\n\n\nTo avoid incurring charges to your Google Cloud account for\nthe resources used on this page, follow these steps.\n\n### Delete regional persistent disks\n\nDelete the regional persistent disks you created for this quickstart:\n\n1. In the Google Cloud console, go to the **Disks** page.\n\n [Go to Disks](https://console.cloud.google.com/compute/disks)\n2. In the list that appears, select both of the disks that you created.\n\n3. To the right of the **Create Disk** button, click **Delete**.\n\n4. In the confirmation dialog that appears, click **Delete**.\n\nA notification dialog appears to confirm the disks were deleted.\n\n### Delete the Project\n\nDelete the Project you created for this quickstart:\n\n1. In the Google Cloud console, go to the **Manage resources** page.\n\n [Go to Manage resources](https://console.cloud.google.com/cloud-resource-manager)\n2. In the drop-down at the top of the page, select the Organization in which\n you created the quickstart Project.\n\n3. In the list of Project resources that appears, select the Project that you\n created, then click **Delete**.\n\n4. On the **Shut down project** dialog that appears, enter the Project ID,\n and then click **Shut down**.\n\nWhat's next\n-----------\n\n- Learn more about [creating and managing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies).\n- Review the [services that support the resource locations constraint](/resource-manager/docs/organization-policy/defining-locations-supported-services)."]]
