Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Mengelola resource fungsi menggunakan batasan kustom
Halaman ini memberikan informasi tambahan untuk menetapkan batasan kustom pada fungsi yang dibuat menggunakan perintah gcloud functions atau Cloud Functions v2 API.
Jika Anda telah membuat atau men-deploy fungsi menggunakan Cloud Run, lihat panduan Mengelola batasan kustom untuk project Cloud Run untuk mengetahui deskripsi mendetail tentang cara menggunakan batasan kustom.
Batasan
Batasan berikut berlaku untuk penggunaan kebijakan organisasi kustom untuk fungsi Cloud Functions v2 API:
Tidak diterapkan untuk nama instance VM saat Anda menggunakan bulk insert API.
Hanya diterapkan pada metode CREATE untuk resource Compute Engine.
Hanya tersedia di Cloud Functions v2 API. Fungsi ini tidak dapat diterapkan pada fungsi Cloud Run (generasi ke-1).
Hanya melindungi fungsi saat menggunakan Cloud Functions v2 API. Fungsi Cloud Run juga dapat diubah
dari Cloud Run API. Untuk perlindungan tambahan, Anda mungkin juga perlu menerapkan batasan kustom di Cloud Run.
Contoh kebijakan organisasi umum
Tabel berikut memberikan sintaksis beberapa kebijakan organisasi kustom
yang mungkin berguna bagi Anda:
Deskripsi
Sintaksis batasan
Mencegah fungsi dibuat dengan bahasa tertentu
name:organizations/ORGANIZATION_ID/customConstraints/custom.cloudFunctionRuntimeBlockresource_types:cloudfunctions.googleapis.com/Functionmethod_types:-CREATE-UPDATEcondition:resource.buildConfig.runtime == "python312"action_type:DENYdisplay_name:Deny functions using Python 3.12description:Functions cannot be created with Python 3.12 as the language runtime
Memerlukan fungsi untuk menggunakan kumpulan pekerja tertentu
name:organizations/ORGANIZATION_ID/customConstraints/custom.cloudFunctionsWorkerPoolresource_types:cloudfunctions.googleapis.com/Functionmethod_types:-CREATE-UPDATEcondition:resource.buildConfig.workerPool == "WORKER_POOL"action_type:DENYdisplay_name:Require worker pooldescription:Functions must use a worker pool
Ganti WORKER_POOL dengan nama kumpulan pekerja Cloud Build Anda.
Mewajibkan fungsi menyimpan semua image container di repositori image tertentu
name:organizations/ORGANIZATION_ID/customConstraints/custom.cloudFunctionsRepositoryresource_types:cloudfunctions.googleapis.com/Functionmethod_types:-CREATE-UPDATEcondition:resource.buildConfig.dockerRepository.startsWith("REPO_PATH")action_type:DENYdisplay_name:Image repository constraintdescription:Functions must push images to a central image repository under REPO_PATH
Ganti REPO_PATH dengan URI URL repositori image tempat Anda ingin semua fungsi menyimpan image container-nya.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-19 UTC."],[[["\u003cp\u003eOrganization administrators can create custom constraints for Cloud Run functions using Organization Policy, allowing for granular control over specific fields at the project, folder, or organization level.\u003c/p\u003e\n"],["\u003cp\u003eCustom constraints offer benefits like cost management, enforcing security requirements, and governing automation scripts by restricting VM instance types, requiring specific firewall rules, or verifying label expressions.\u003c/p\u003e\n"],["\u003cp\u003eCustom constraints are defined in YAML files specifying resources, methods, conditions (using Common Expression Language), and actions, and they can be enforced at the project level using the \u003ccode\u003egcloud\u003c/code\u003e command-line tool or the Google Cloud console.\u003c/p\u003e\n"],["\u003cp\u003eCustom constraints are only enforced on Cloud Functions v2 APIs, not Cloud Run functions (1st gen), and are only applied to the \u003ccode\u003eCREATE\u003c/code\u003e method for Compute Engine resources.\u003c/p\u003e\n"],["\u003cp\u003eCustom organization policies can be set to deny the creation of functions with a specific language, require functions to use a specific worker pool, and require functions to store container images in a specific image repository.\u003c/p\u003e\n"]]],[],null,["# Manage function resources using custom constraints\n==================================================\n\nThis page provides supplemental information for setting custom constraints on\nfunctions created using\n[`gcloud functions`](/sdk/gcloud/reference/functions) commands or the\n[Cloud Functions v2 API](/functions/docs/reference/rest).\n\nIf you've created or deployed functions using Cloud Run, see\nCloud Run's\n[Manage custom constraints for projects](/run/docs/securing/custom-constraints)\nguide for a detailed description of how to use custom constraints.\n\nLimitations\n-----------\n\nThe following limitations apply to using custom organization policies for\n[Cloud Functions v2 API](/functions/docs/reference/rest) functions:\n\n- Not enforced for VM instance names when you use the [bulk insert API](/compute/docs/instances/multiple/about-bulk-creation).\n- Only enforced on the `CREATE` method for Compute Engine resources.\n- Only available on [Cloud Functions\n v2 API](/functions/docs/reference/rest). They can't be applied on Cloud Run functions (1st gen).\n- Only protects functions when using the Cloud Functions v2 API. Cloud Run functions can also be modified from the Cloud Run API as well. For additional protection, you might need to also [apply custom constraints on Cloud Run](/run/docs/securing/custom-constraints) as well.\n\nCommon organization policy examples\n-----------------------------------\n\nThe following table provides the syntax of some custom organization policies\nthat you might find useful:\n\nWhat's next\n-----------\n\n- See [Introduction to the Organization Policy Service](/resource-manager/docs/organization-policy/overview) to learn more about organization policies.\n- Learn more about how to [create and manage organization policies](/resource-manager/docs/organization-policy/using-constraints).\n- See the full list of predefined [organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)."]]
