403 policy config_error ai_generated true

资源'projects/my-project/global/images/my-image'被策略禁止。策略：'constraints/compute.restrictNoncompliantImages'。原因：资源位置不允许。

Resource 'projects/my-project/global/images/my-image' was disallowed by policy. Policy: 'constraints/compute.restrictNoncompliantImages'. Reason: 'The resource location is not allowed.'

ID: policy/gcp-resource-location-restricted

其他格式: JSON · Markdown 中文 · English
85%修复率
86%置信度
1证据数
2024-04-22首次发现

版本兼容性

版本状态引入弃用备注
GCP Compute Engine active — — —
Organization Policy Service active — — —

根因分析

Google Cloud组织策略将计算资源限制在特定位置，但镜像位于全局或不合规位置。

English

Google Cloud Organization Policy restricts compute resources to specific locations, but the image is in a global or non-compliant location.

generic

官方文档

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints

解决方案

  1. 使用gcloud compute images create命令，指定--source-image和--source-image-project，将镜像复制到合规区域如us-central1。示例：'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'。
  2. 联系GCP组织管理员，更新策略以允许所需位置，或为特定项目添加例外。

无效尝试

常见但无效的做法:

  1. 85% 失败

    The constraint restricts the location where the image can be used, not stored; moving the image does not resolve the policy violation.

  2. 90% 失败

    The policy applies to all compute resources; recreating in a non-compliant location will still fail.

  3. 70% 失败

    Requires org admin privileges and may violate compliance requirements; not a practical fix for most users.