Eventarc Advanced tidak mematuhi
sertifikasi dan standar yang didukung oleh
Eventarc Standard. Jika organisasi Anda memerlukan kepatuhan terhadap standar ini, Anda dapat menonaktifkan pembuatan atau pembaruan resource Eventarc Lanjutan.
Sebelum memulai
Sebelum Anda menonaktifkan resource Eventarc Advanced, pastikan
prasyarat berikut terpenuhi:
Untuk mendapatkan izin yang diperlukan untuk mengelola kebijakan organisasi kustom, minta administrator untuk memberi Anda peran IAM Administrator Kebijakan Organisasi (roles/orgpolicy.policyAdmin) di resource organisasi.
Membuat batasan khusus
Anda dapat membuat batasan kustom dan menggunakan batasan kustom ini dalam kebijakan organisasi untuk mencegah pembuatan dan pembaruan resource Eventarc Advanced baru.
Untuk membuat batasan khusus, buat file YAML menggunakan format berikut:
ORGANIZATION_ID: ID organisasi Anda, seperti 123456789.
CONSTRAINT_NAME: nama yang Anda inginkan untuk batasan kustom baru. Batasan kustom harus diawali dengan custom., dan hanya boleh menyertakan huruf besar, huruf kecil, atau angka. Contohnya,
custom.disableEventarcAdvancedResources. Panjang
maksimum kolom ini adalah 70 karakter.
Batasan kustom berlaku untuk jenis resource Eventarc Advanced berikut:
Enrollment
GoogleApiSource
MessageBus
Pipeline
Menyiapkan batasan kustom
Setelah membuat file YAML untuk batasan khusus baru, Anda harus menyiapkannya agar tersedia untuk kebijakan organisasi di organisasi Anda. Untuk menyiapkan batasan kustom, gunakan perintah gcloud org-policies set-custom-constraint:
Ganti CONSTRAINT_PATH dengan jalur lengkap ke file batasan kustom Anda. Contohnya, /home/user/customconstraint.yaml
Setelah selesai, batasan khusus Anda tersedia sebagai kebijakan organisasi dalam daftar kebijakan organisasi. Google Cloud
Untuk memverifikasi bahwa ada batasan kustom, gunakan perintah
gcloud org-policies list-custom-constraints:
Ganti ORGANIZATION_ID dengan ID resource organisasi Anda.
Untuk mengetahui informasi selengkapnya, lihat
Melihat kebijakan organisasi.
Menerapkan kebijakan organisasi kustom
Anda dapat menerapkan batasan dengan membuat kebijakan organisasi yang mereferensikannya, lalu menerapkan kebijakan organisasi tersebut ke resource Google Cloud .
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-02 UTC."],[],[],null,["# Disable Eventarc Advanced resources\n\n[Standard](/eventarc/standard/docs/overview)\n\nThis guide describes how to disable Eventarc Advanced resources\n[using custom organization policies](/eventarc/standard/docs/custom-constraints).\n\nEventarc Advanced is not compliant with\n[certifications and standards](/eventarc/docs/compliance) that are supported by\nEventarc Standard. If your organization requires compliance with\nthese standards, you can disable the creation or updating of\nEventarc Advanced resources.\n\nBefore you begin\n----------------\n\nBefore you disable Eventarc Advanced resources, make sure that\nthe following prerequisites are met:\n\n- You know your Google Cloud [organization ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n- To get the permissions that you need to manage custom organization policies, ask your administrator to grant you the [Organization Policy Administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`) IAM role on the organization resource.\n\nCreate a custom constraint\n--------------------------\n\nYou can create a custom constraint and use this custom constraint in an\norganization policy to prevent the creating and updating of new\nEventarc Advanced resources.\n| **Note:** Any existing Eventarc Advanced resources created prior to enabling the organization policy continue to function after you enable the policy.\n\n1. To create a custom constraint, create a YAML file using the following format:\n\n name: organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/customConstraints/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n resourceTypes:\n -eventarc.googleapis.com/Enrollment\n -eventarc.googleapis.com/GoogleApiSource\n -eventarc.googleapis.com/MessageBus\n -eventarc.googleapis.com/Pipeline\n methodTypes:\n - CREATE\n - UPDATE\n condition: \"true\"\n actionType: DENY\n description: \"Disable Eventarc Advanced resources\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: your organization ID, such as\n `123456789`.\n\n - \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e: the name you want for your new\n custom constraint. A custom constraint must start with `custom.`, and can\n only include uppercase letters, lowercase letters, or numbers. For\n example, `custom.disableEventarcAdvancedResources`. The maximum\n length of this field is 70 characters.\n\n The custom constraint applies to the following Eventarc Advanced\n resource types:\n - `Enrollment`\n - `GoogleApiSource`\n - `MessageBus`\n - `Pipeline`\n\nSet up a custom constraint\n--------------------------\n\nAfter you have created the YAML file for a new custom constraint, you must set it up to make it available for organization policies in your organization. To set up a custom constraint, use the `gcloud org-policies set-custom-constraint` command: \n\n```bash\ngcloud org-policies set-custom-constraint CONSTRAINT_PATH\n```\nReplace \u003cvar translate=\"no\"\u003eCONSTRAINT_PATH\u003c/var\u003e with the full path to your custom constraint file. For example, `/home/user/customconstraint.yaml`. Once completed, your custom constraints are available as organization policies in your list of Google Cloud organization policies. To verify that the custom constraint exists, use the `gcloud org-policies list-custom-constraints` command: \n\n```bash\ngcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID\n```\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the ID of your organization resource. For more information, see [Viewing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies#viewing_organization_policies).\n\nEnforce a custom organization policy\n------------------------------------\n\nYou can enforce a constraint by creating an organization policy that references it, and then applying that organization policy to a Google Cloud resource.\n\n### Console\n\n1. In the Google Cloud console, go to the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. From the project picker, select the project for which you want to set the organization policy.\n3. From the list on the **Organization policies** page, select your constraint to view the **Policy details** page for that constraint.\n4. To configure the organization policy for this resource, click **Manage policy**.\n5. On the **Edit policy** page, select **Override parent's policy**.\n6. Click **Add a rule**.\n7. In the **Enforcement** section, select whether enforcement of this organization policy is on or off.\n8. Optional: To make the organization policy conditional on a tag, click **Add condition** . Note that if you add a conditional rule to an organization policy, you must add at least one unconditional rule or the policy cannot be saved. For more information, see [Setting an organization policy with tags](/resource-manager/docs/organization-policy/tags-organization-policy).\n9. Click **Test changes** to simulate the effect of the organization policy. Policy simulation isn't available for legacy managed constraints. For more information, see [Test organization policy changes with Policy Simulator](/policy-intelligence/docs/test-organization-policies).\n10. To finish and apply the organization policy, click **Set policy**. The policy requires up to 15 minutes to take effect.\n\n### gcloud\n\n\nTo create an organization policy with boolean rules, create a policy YAML file that\nreferences the constraint: \n\n```yaml\n name: projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/policies/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n spec:\n rules:\n - enforce: true\n \n```\n\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project on which you want to enforce your constraint.\n- \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e: the name of the constraint you want to enforce. For example, `compute.disableAllIpv6`.\n\n\nTo enforce the organization policy containing the constraint, run the following command: \n\n```bash\n gcloud org-policies set-policy POLICY_PATH\n \n```\n\n\nReplace \u003cvar translate=\"no\"\u003ePOLICY_PATH\u003c/var\u003e with the full path to your organization policy\nYAML file. The policy requires up to 15 minutes to take effect.\n\nWhat's next\n-----------\n\n- Learn more about [organization policies](/resource-manager/docs/organization-policy/overview)\n- Understand [Eventarc Advanced](/eventarc/advanced/docs/overview)"]]
