# Operation failed: Access denied due to organization policy: constraint/compute.vmExternalIpAccess violated for project <project-id>

- **ID:** `policy/gcp-org-policy-restrict-vm-external-ip`
- **Domain:** policy
- **Category:** config_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

GCP organization policy 'compute.vmExternalIpAccess' blocks creating VMs with external IPs; the constraint is enforced at the organization, folder, or project level.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Google Cloud SDK 450.0.0 | active | — | — |
| Compute Engine API v1 | active | — | — |
| Organization Policy Service | active | — | — |

## Workarounds

1. **Create the VM without an external IP: gcloud compute instances create <instance-name> --no-address --zone=<zone>. Then use Cloud NAT or a bastion host for outbound connectivity.** (90% success)
   ```
   Create the VM without an external IP: gcloud compute instances create <instance-name> --no-address --zone=<zone>. Then use Cloud NAT or a bastion host for outbound connectivity.
   ```
2. **Request an exception to the organization policy from your GCP admin: have them add your project to the allowed list via the Organization Policies console.** (70% success)
   ```
   Request an exception to the organization policy from your GCP admin: have them add your project to the allowed list via the Organization Policies console.
   ```
3. **Use a Shared VPC with a proxy subnet that has external IP allowed, then launch the VM in that subnet without direct external IP.** (75% success)
   ```
   Use a Shared VPC with a proxy subnet that has external IP allowed, then launch the VM in that subnet without direct external IP.
   ```

## Dead Ends

- **** — Setting VM to use an ephemeral external IP manually in gcloud still fails because the policy blocks all external IP assignment. (80% fail)
- **** — Removing the VM and recreating without specifying --no-address still triggers the policy if the default network has external IP. (70% fail)
- **** — Creating a VM in a different project without checking its policy may still fail if the organization policy applies across projects. (60% fail)