policy config_error ai_generated partial

资源'projects/my-project/global/images/my-image'被策略禁止。策略：'constraints/compute.restrictNoncompliantImage'。

Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImage'.

ID: policy/gcp-compute-restrict-noncompliant-image

其他格式: JSON · Markdown 中文 · English
72%修复率
83%置信度
1证据数
2024-01-22首次发现

版本兼容性

版本状态引入弃用备注
Google Compute Engine 2024-03 active — — —
gcloud 450.0.0 active — — —

根因分析

GCP组织策略constraints/compute.restrictNoncompliantImage阻止使用未批准或不符合合规标准的镜像。

English

GCP Organization Policy constraints/compute.restrictNoncompliantImage blocks the use of images that are not approved or do not meet compliance standards.

generic

官方文档

https://cloud.google.com/compute/docs/images/restricting-image-access

解决方案

  1. 使用允许列表中的合规镜像（例如，官方Debian或Ubuntu镜像）。示例：`gcloud compute instances create my-instance --image-family ubuntu-2204-lts --image-project ubuntu-os-cloud`
  2. 向组织策略管理员请求例外，允许特定镜像。
  3. 重建自定义镜像以满足合规标准（例如，包含所需安全补丁）并重新导入。

无效尝试

常见但无效的做法:

  1. 85% 失败

    The policy checks the image's compliance status, not just the name; using another noncompliant image will also fail.

  2. 90% 失败

    Requires org-level admin permissions and may violate compliance requirements.

  3. 95% 失败

    Public access does not override organization policies; the policy still applies.