policy config_error ai_generated true

操作失败：由于组织策略，访问被拒绝：constraint/compute.vmExternalIpAccess 违反了项目 <project-id>

Operation failed: Access denied due to organization policy: constraint/compute.vmExternalIpAccess violated for project <project-id>

ID: policy/gcp-org-policy-restrict-vm-external-ip

其他格式: JSON · Markdown 中文 · English
85%修复率
87%置信度
1证据数
2023-11-10首次发现

版本兼容性

版本状态引入弃用备注
Google Cloud SDK 450.0.0 active — — —
Compute Engine API v1 active — — —
Organization Policy Service active — — —

根因分析

GCP 组织策略 'compute.vmExternalIpAccess' 阻止创建具有外部 IP 的 VM；该约束在组织、文件夹或项目级别强制执行。

English

GCP organization policy 'compute.vmExternalIpAccess' blocks creating VMs with external IPs; the constraint is enforced at the organization, folder, or project level.

generic

官方文档

https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#organization_policy

解决方案

  1. 创建没有外部 IP 的 VM：gcloud compute instances create <instance-name> --no-address --zone=<zone>。然后使用 Cloud NAT 或堡垒主机进行出站连接。
  2. 向 GCP 管理员请求组织策略的例外：让他们通过组织策略控制台将你的项目添加到允许列表。
  3. 使用具有允许外部 IP 的代理子网的共享 VPC，然后在该子网中启动 VM，不直接分配外部 IP。

无效尝试

常见但无效的做法:

  1. 80% 失败

    Setting VM to use an ephemeral external IP manually in gcloud still fails because the policy blocks all external IP assignment.

  2. 70% 失败

    Removing the VM and recreating without specifying --no-address still triggers the policy if the default network has external IP.

  3. 60% 失败

    Creating a VM in a different project without checking its policy may still fail if the organization policy applies across projects.