policy config_error ai_generated partial

Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImage'.

ID: policy/gcp-compute-restrict-noncompliant-image

Also available as: JSON · Markdown · 中文
72%Fix Rate
83%Confidence
1Evidence
2024-01-22First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Google Compute Engine 2024-03 active — — —
gcloud 450.0.0 active — — —

Root Cause

GCP Organization Policy constraints/compute.restrictNoncompliantImage blocks the use of images that are not approved or do not meet compliance standards.

generic

中文

GCP组织策略constraints/compute.restrictNoncompliantImage阻止使用未批准或不符合合规标准的镜像。

Official Documentation

https://cloud.google.com/compute/docs/images/restricting-image-access

Workarounds

  1. 85% success Use a compliant image from the allowed list (e.g., official Debian or Ubuntu images). Example: `gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud` 
    Use a compliant image from the allowed list (e.g., official Debian or Ubuntu images). Example: `gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`
  2. 70% success Request an exception from the organization policy administrator to allow the specific image. 
    Request an exception from the organization policy administrator to allow the specific image.
  3. 75% success Rebuild the custom image to meet compliance standards (e.g., include required security patches) and re-import it. 
    Rebuild the custom image to meet compliance standards (e.g., include required security patches) and re-import it.

中文步骤

  1. 使用允许列表中的合规镜像（例如，官方Debian或Ubuntu镜像）。示例：`gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`
  2. 向组织策略管理员请求例外，允许特定镜像。
  3. 重建自定义镜像以满足合规标准（例如，包含所需安全补丁）并重新导入。

Dead Ends

Common approaches that don't work:

  1. 85% fail

    The policy checks the image's compliance status, not just the name; using another noncompliant image will also fail.

  2. 90% fail

    Requires org-level admin permissions and may violate compliance requirements.

  3. 95% fail

    Public access does not override organization policies; the policy still applies.