403 policy config_error ai_generated true

Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImages'. Reason: 'The resource location is not allowed.'

ID: policy/gcp-resource-location-restricted

Also available as: JSON · Markdown · 中文
85%Fix Rate
86%Confidence
1Evidence
2024-04-22First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
GCP Compute Engine active — — —
Organization Policy Service active — — —

Root Cause

Google Cloud Organization Policy restricts compute resources to specific locations, but the image is in a global or non-compliant location.

generic

中文

Google Cloud组织策略将计算资源限制在特定位置，但镜像位于全局或不合规位置。

Official Documentation

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints

Workarounds

  1. 85% success Copy the image to a compliant region using gcloud compute images create with --source-image and --source-image-project, specifying a compliant region like us-central1. Example: 'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'. 
    Copy the image to a compliant region using gcloud compute images create with --source-image and --source-image-project, specifying a compliant region like us-central1. Example: 'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'.
  2. 75% success Contact your GCP organization admin to update the policy to allow the required location or add an exception for the specific project. 
    Contact your GCP organization admin to update the policy to allow the required location or add an exception for the specific project.

中文步骤

  1. 使用gcloud compute images create命令，指定--source-image和--source-image-project，将镜像复制到合规区域如us-central1。示例：'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'。
  2. 联系GCP组织管理员，更新策略以允许所需位置，或为特定项目添加例外。

Dead Ends

Common approaches that don't work:

  1. 85% fail

    The constraint restricts the location where the image can be used, not stored; moving the image does not resolve the policy violation.

  2. 90% fail

    The policy applies to all compute resources; recreating in a non-compliant location will still fail.

  3. 70% fail

    Requires org admin privileges and may violate compliance requirements; not a practical fix for most users.