{
  "id": "policy/gcp-resource-location-restricted",
  "signature": "Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImages'. Reason: 'The resource location is not allowed.'",
  "signature_zh": "资源'projects/my-project/global/images/my-image'被策略禁止。策略：'constraints/compute.restrictNoncompliantImages'。原因：资源位置不允许。",
  "regex": "Resource '.*' was disallowed by policy\\. Policy: 'constraints/compute\\.restrictNoncompliantImages'\\.",
  "domain": "policy",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "Google Cloud Organization Policy restricts compute resources to specific locations, but the image is in a global or non-compliant location.",
  "root_cause_type": "generic",
  "root_cause_zh": "Google Cloud组织策略将计算资源限制在特定位置，但镜像位于全局或不合规位置。",
  "versions": [
    {
      "version": "GCP Compute Engine",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Organization Policy Service",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "The constraint restricts the location where the image can be used, not stored; moving the image does not resolve the policy violation.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "The policy applies to all compute resources; recreating in a non-compliant location will still fail.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Requires org admin privileges and may violate compliance requirements; not a practical fix for most users.",
      "fail_rate": 0.7,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Copy the image to a compliant region using gcloud compute images create with --source-image and --source-image-project, specifying a compliant region like us-central1. Example: 'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'.",
      "success_rate": 0.85,
      "how": "Copy the image to a compliant region using gcloud compute images create with --source-image and --source-image-project, specifying a compliant region like us-central1. Example: 'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Contact your GCP organization admin to update the policy to allow the required location or add an exception for the specific project.",
      "success_rate": 0.75,
      "how": "Contact your GCP organization admin to update the policy to allow the required location or add an exception for the specific project.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "使用gcloud compute images create命令，指定--source-image和--source-image-project，将镜像复制到合规区域如us-central1。示例：'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'。",
    "联系GCP组织管理员，更新策略以允许所需位置，或为特定项目添加例外。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints",
  "official_doc_section": null,
  "error_code": "403",
  "verification_tier": "ai_generated",
  "confidence": 0.86,
  "fix_success_rate": 0.85,
  "resolvable": "true",
  "first_seen": "2024-04-22",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}