# 资源'projects/my-project/global/images/my-image'被策略禁止。策略：'constraints/compute.restrictNoncompliantImages'。原因：资源位置不允许。

- **ID:** `policy/gcp-resource-location-restricted`
- **领域:** policy
- **类别:** config_error
- **错误码:** `403`
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

Google Cloud组织策略将计算资源限制在特定位置，但镜像位于全局或不合规位置。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| GCP Compute Engine | active | — | — |
| Organization Policy Service | active | — | — |

## 解决方案

1. ```
   使用gcloud compute images create命令，指定--source-image和--source-image-project，将镜像复制到合规区域如us-central1。示例：'gcloud compute images create my-image-us --source-image=my-image --source-image-project=my-project --region=us-central1'。
   ```
2. ```
   联系GCP组织管理员，更新策略以允许所需位置，或为特定项目添加例外。
   ```

## 无效尝试

- **** — The constraint restricts the location where the image can be used, not stored; moving the image does not resolve the policy violation. (85% 失败率)
- **** — The policy applies to all compute resources; recreating in a non-compliant location will still fail. (90% 失败率)
- **** — Requires org admin privileges and may violate compliance requirements; not a practical fix for most users. (70% 失败率)