O Eventarc Advanced não está em conformidade com
certificações e padrões compatíveis com o
Eventarc Standard. Se a sua organização precisar obedecer a esses padrões, desative a criação ou atualização de recursos avançados do Eventarc.
Antes de começar
Antes de desativar os recursos avançados do Eventarc, verifique se os seguintes pré-requisitos foram atendidos:
Para receber as permissões necessárias para gerenciar políticas personalizadas da organização,
peça ao administrador para conceder a você o
papel do IAM de Administrador da política da organização
(roles/orgpolicy.policyAdmin) no recurso
da organização.
Criar uma restrição personalizada
É possível criar uma restrição personalizada e usá-la em uma política da organização para impedir a criação e atualização de novos recursos avançados do Eventarc.
Para criar uma restrição personalizada, crie um arquivo YAML usando o seguinte formato:
ORGANIZATION_ID: o ID da organização, como
123456789.
CONSTRAINT_NAME: o nome da sua nova restrição personalizada. Uma restrição personalizada precisa começar com custom. e só pode
incluir letras maiúsculas, minúsculas ou números. Por exemplo, custom.disableEventarcAdvancedResources. O comprimento máximo desse campo é de 70 caracteres.
A restrição personalizada se aplica aos seguintes tipos de recursos do Eventarc Advanced:
Enrollment
GoogleApiSource
MessageBus
Pipeline
Configurar uma restrição personalizada
Depois de criar o arquivo YAML para uma nova restrição personalizada, configure-a para
disponibilizá-la para as políticas da organização. Para configurar uma restrição personalizada, use o comando gcloud org-policies set-custom-constraint:
Substitua CONSTRAINT_PATH pelo caminho completo
do arquivo da restrição personalizada. Por exemplo, /home/user/customconstraint.yaml.
Após a conclusão, as restrições personalizadas vão estar disponíveis como políticas da organização
na sua lista de Google Cloud políticas da organização.
Para verificar se a restrição personalizada existe, use o comando gcloud org-policies list-custom-constraints:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-02 UTC."],[],[],null,["# Disable Eventarc Advanced resources\n\n[Standard](/eventarc/standard/docs/overview)\n\nThis guide describes how to disable Eventarc Advanced resources\n[using custom organization policies](/eventarc/standard/docs/custom-constraints).\n\nEventarc Advanced is not compliant with\n[certifications and standards](/eventarc/docs/compliance) that are supported by\nEventarc Standard. If your organization requires compliance with\nthese standards, you can disable the creation or updating of\nEventarc Advanced resources.\n\nBefore you begin\n----------------\n\nBefore you disable Eventarc Advanced resources, make sure that\nthe following prerequisites are met:\n\n- You know your Google Cloud [organization ID](/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id).\n- To get the permissions that you need to manage custom organization policies, ask your administrator to grant you the [Organization Policy Administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`) IAM role on the organization resource.\n\nCreate a custom constraint\n--------------------------\n\nYou can create a custom constraint and use this custom constraint in an\norganization policy to prevent the creating and updating of new\nEventarc Advanced resources.\n| **Note:** Any existing Eventarc Advanced resources created prior to enabling the organization policy continue to function after you enable the policy.\n\n1. To create a custom constraint, create a YAML file using the following format:\n\n name: organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/customConstraints/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n resourceTypes:\n -eventarc.googleapis.com/Enrollment\n -eventarc.googleapis.com/GoogleApiSource\n -eventarc.googleapis.com/MessageBus\n -eventarc.googleapis.com/Pipeline\n methodTypes:\n - CREATE\n - UPDATE\n condition: \"true\"\n actionType: DENY\n description: \"Disable Eventarc Advanced resources\"\n\n Replace the following:\n - \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e: your organization ID, such as\n `123456789`.\n\n - \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e: the name you want for your new\n custom constraint. A custom constraint must start with `custom.`, and can\n only include uppercase letters, lowercase letters, or numbers. For\n example, `custom.disableEventarcAdvancedResources`. The maximum\n length of this field is 70 characters.\n\n The custom constraint applies to the following Eventarc Advanced\n resource types:\n - `Enrollment`\n - `GoogleApiSource`\n - `MessageBus`\n - `Pipeline`\n\nSet up a custom constraint\n--------------------------\n\nAfter you have created the YAML file for a new custom constraint, you must set it up to make it available for organization policies in your organization. To set up a custom constraint, use the `gcloud org-policies set-custom-constraint` command: \n\n```bash\ngcloud org-policies set-custom-constraint CONSTRAINT_PATH\n```\nReplace \u003cvar translate=\"no\"\u003eCONSTRAINT_PATH\u003c/var\u003e with the full path to your custom constraint file. For example, `/home/user/customconstraint.yaml`. Once completed, your custom constraints are available as organization policies in your list of Google Cloud organization policies. To verify that the custom constraint exists, use the `gcloud org-policies list-custom-constraints` command: \n\n```bash\ngcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID\n```\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the ID of your organization resource. For more information, see [Viewing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies#viewing_organization_policies).\n\nEnforce a custom organization policy\n------------------------------------\n\nYou can enforce a constraint by creating an organization policy that references it, and then applying that organization policy to a Google Cloud resource.\n\n### Console\n\n1. In the Google Cloud console, go to the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. From the project picker, select the project for which you want to set the organization policy.\n3. From the list on the **Organization policies** page, select your constraint to view the **Policy details** page for that constraint.\n4. To configure the organization policy for this resource, click **Manage policy**.\n5. On the **Edit policy** page, select **Override parent's policy**.\n6. Click **Add a rule**.\n7. In the **Enforcement** section, select whether enforcement of this organization policy is on or off.\n8. Optional: To make the organization policy conditional on a tag, click **Add condition** . Note that if you add a conditional rule to an organization policy, you must add at least one unconditional rule or the policy cannot be saved. For more information, see [Setting an organization policy with tags](/resource-manager/docs/organization-policy/tags-organization-policy).\n9. Click **Test changes** to simulate the effect of the organization policy. Policy simulation isn't available for legacy managed constraints. For more information, see [Test organization policy changes with Policy Simulator](/policy-intelligence/docs/test-organization-policies).\n10. To finish and apply the organization policy, click **Set policy**. The policy requires up to 15 minutes to take effect.\n\n### gcloud\n\n\nTo create an organization policy with boolean rules, create a policy YAML file that\nreferences the constraint: \n\n```yaml\n name: projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/policies/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\n spec:\n rules:\n - enforce: true\n \n```\n\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: the project on which you want to enforce your constraint.\n- \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e: the name of the constraint you want to enforce. For example, `compute.disableAllIpv6`.\n\n\nTo enforce the organization policy containing the constraint, run the following command: \n\n```bash\n gcloud org-policies set-policy POLICY_PATH\n \n```\n\n\nReplace \u003cvar translate=\"no\"\u003ePOLICY_PATH\u003c/var\u003e with the full path to your organization policy\nYAML file. The policy requires up to 15 minutes to take effect.\n\nWhat's next\n-----------\n\n- Learn more about [organization policies](/resource-manager/docs/organization-policy/overview)\n- Understand [Eventarc Advanced](/eventarc/advanced/docs/overview)"]]
