policy config_error ai_generated true

Operation failed: Access denied due to organization policy: constraint/compute.vmExternalIpAccess violated for project <project-id>

ID: policy/gcp-org-policy-restrict-vm-external-ip

Also available as: JSON · Markdown · 中文
85%Fix Rate
87%Confidence
1Evidence
2023-11-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Google Cloud SDK 450.0.0 active — — —
Compute Engine API v1 active — — —
Organization Policy Service active — — —

Root Cause

GCP organization policy 'compute.vmExternalIpAccess' blocks creating VMs with external IPs; the constraint is enforced at the organization, folder, or project level.

generic

中文

GCP 组织策略 'compute.vmExternalIpAccess' 阻止创建具有外部 IP 的 VM；该约束在组织、文件夹或项目级别强制执行。

Official Documentation

https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#organization_policy

Workarounds

  1. 90% success Create the VM without an external IP: gcloud compute instances create <instance-name> --no-address --zone=<zone>. Then use Cloud NAT or a bastion host for outbound connectivity. 
    Create the VM without an external IP: gcloud compute instances create <instance-name> --no-address --zone=<zone>. Then use Cloud NAT or a bastion host for outbound connectivity.
  2. 70% success Request an exception to the organization policy from your GCP admin: have them add your project to the allowed list via the Organization Policies console. 
    Request an exception to the organization policy from your GCP admin: have them add your project to the allowed list via the Organization Policies console.
  3. 75% success Use a Shared VPC with a proxy subnet that has external IP allowed, then launch the VM in that subnet without direct external IP. 
    Use a Shared VPC with a proxy subnet that has external IP allowed, then launch the VM in that subnet without direct external IP.

中文步骤

  1. 创建没有外部 IP 的 VM：gcloud compute instances create <instance-name> --no-address --zone=<zone>。然后使用 Cloud NAT 或堡垒主机进行出站连接。
  2. 向 GCP 管理员请求组织策略的例外：让他们通过组织策略控制台将你的项目添加到允许列表。
  3. 使用具有允许外部 IP 的代理子网的共享 VPC，然后在该子网中启动 VM，不直接分配外部 IP。

Dead Ends

Common approaches that don't work:

  1. 80% fail

    Setting VM to use an ephemeral external IP manually in gcloud still fails because the policy blocks all external IP assignment.

  2. 70% fail

    Removing the VM and recreating without specifying --no-address still triggers the policy if the default network has external IP.

  3. 60% fail

    Creating a VM in a different project without checking its policy may still fail if the organization policy applies across projects.