{
  "id": "policy/gcp-compute-restrict-noncompliant-image",
  "signature": "Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImage'.",
  "signature_zh": "资源'projects/my-project/global/images/my-image'被策略禁止。策略：'constraints/compute.restrictNoncompliantImage'。",
  "regex": "Resource '.*' was disallowed by policy\\. Policy: 'constraints/compute\\.restrictNoncompliantImage'\\.",
  "domain": "policy",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "GCP Organization Policy constraints/compute.restrictNoncompliantImage blocks the use of images that are not approved or do not meet compliance standards.",
  "root_cause_type": "generic",
  "root_cause_zh": "GCP组织策略constraints/compute.restrictNoncompliantImage阻止使用未批准或不符合合规标准的镜像。",
  "versions": [
    {
      "version": "Google Compute Engine 2024-03",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "gcloud 450.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "The policy checks the image's compliance status, not just the name; using another noncompliant image will also fail.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Requires org-level admin permissions and may violate compliance requirements.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Public access does not override organization policies; the policy still applies.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Use a compliant image from the allowed list (e.g., official Debian or Ubuntu images). Example: `gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`",
      "success_rate": 0.85,
      "how": "Use a compliant image from the allowed list (e.g., official Debian or Ubuntu images). Example: `gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`",
      "condition": "",
      "sources": []
    },
    {
      "action": "Request an exception from the organization policy administrator to allow the specific image.",
      "success_rate": 0.7,
      "how": "Request an exception from the organization policy administrator to allow the specific image.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Rebuild the custom image to meet compliance standards (e.g., include required security patches) and re-import it.",
      "success_rate": 0.75,
      "how": "Rebuild the custom image to meet compliance standards (e.g., include required security patches) and re-import it.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "使用允许列表中的合规镜像（例如，官方Debian或Ubuntu镜像）。示例：`gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`",
    "向组织策略管理员请求例外，允许特定镜像。",
    "重建自定义镜像以满足合规标准（例如，包含所需安全补丁）并重新导入。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://cloud.google.com/compute/docs/images/restricting-image-access",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.83,
  "fix_success_rate": 0.72,
  "resolvable": "partial",
  "first_seen": "2024-01-22",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}