本頁面由 Cloud Translation API 翻譯而成。

使用自訂限制條件管理 Cloud Load Balancing 資源

Google Cloud 機構政策可讓您透過程式以集中方式控管機構資源。身為機構政策管理員，您可以定義機構政策，也就是一組稱為限制的限制，適用於 Google Cloud 資源階層中的Google Cloud 資源和這些資源的子系。您可以在機構、資料夾或專案層級強制執行機構政策。

機構政策為各種Google Cloud 服務提供預先定義的限制。不過，如果您想進一步控管貴機構政策中受限制的特定欄位，並且進一步細微控管這些欄位，也可以建立自訂限制，並在自訂機構政策中使用這些自訂限制。

下列負載平衡器元件支援自訂限制：

Compute Engine 資源 (例如執行個體群組) 和 VPC 資源 (例如VPC 網路和子網路) 也支援自訂限制。

優點

成本管理：使用自訂機構政策限制健康狀態檢查探測頻率。
安全性、法規遵循和治理：您可以使用自訂機構政策來強制執行政策。例如：
- 強制使用特定健康狀態檢查通訊協定或通訊埠範圍
- 如要禁止特定後端流量通訊協定
- 要求後端值區必須啟用 Cloud CDN
- 要求轉送規則使用特定網路服務級別

Cloud Load Balancing 支援的資源

針對 Cloud Load Balancing，您可以針對下列資源和欄位設定自訂限制。

後端值區

後端資料集：compute.googleapis.com/BackendBucket

resource.name
resource.description
resource.bucketName
resource.enableCdn
resource.cdnPolicy
- resource.cdnPolicy.bypassCacheOnRequestHeaders
  - resource.cdnPolicy.bypassCacheOnRequestHeaders.headerName
- resource.cdnPolicy.cacheKeyPolicy
  - resource.cdnPolicy.cacheKeyPolicy.includeHttpHeaders
  - resource.cdnPolicy.cacheKeyPolicy.queryStringWhitelist
  - resource.cdnPolicy.signedUrlCacheMaxAgeSec
- resource.compressionMode
- resource.customResponseHeaders

後端服務

後端服務：compute.googleapis.com/BackendService

resource.name
resource.description
resource.port
resource.portName
resource.protocol
resource.backends
- resource.backends.balancingMode
- resource.backends.capacityScaler
- resource.backends.description
- resource.backends.failover
- resource.backends.maxConnections
- resource.backends.maxConnectionsPerEndpoint
- resource.backends.maxConnectionsPerInstance
- resource.backends.maxRate
- resource.backends.maxRatePerEndpoint
- resource.backends.maxRatePerInstance
- resource.backends.maxUtilization
- resource.backends.preference
resource.enableCDN
resource.cdnPolicy
- resource.cdnPolicy.bypassCacheOnRequestHeaders
  - resource.cdnPolicy.bypassCacheOnRequestHeaders.headerName
- resource.cdnPolicy.cacheKeyPolicy
  - resource.cdnPolicy.cacheKeyPolicy.includeHost
  - resource.cdnPolicy.cacheKeyPolicy.includeHttpHeaders
  - resource.cdnPolicy.cacheKeyPolicy.includeNamedCookies
  - resource.cdnPolicy.cacheKeyPolicy.includeProtocol
  - resource.cdnPolicy.cacheKeyPolicy.includeQueryString
  - resource.cdnPolicy.cacheKeyPolicy.queryStringBlacklist
  - resource.cdnPolicy.cacheKeyPolicy.queryStringWhitelist
- resource.cdnPolicy.cacheMode
- resource.cdnPolicy.clientTtl
- resource.cdnPolicy.defaultTtl
- resource.cdnPolicy.maxTtl
- resource.cdnPolicy.negativeCaching
- resource.cdnPolicy.negativeCachingPolicy
  - resource.cdnPolicy.negativeCachingPolicy.code
  - resource.cdnPolicy.negativeCachingPolicy.ttl
- resource.cdnPolicy.requestCoalescing
- resource.cdnPolicy.serveWhileStale
- resource.cdnPolicy.signedUrlCacheMaxAgeSec
resource.circuitBreakers
- resource.circuitBreakers.maxConnections
- resource.circuitBreakers.maxPendingRequests
- resource.circuitBreakers.maxRequests
- resource.circuitBreakers.maxRequestsPerConnection
- resource.circuitBreakers.maxRetries
resource.compressionMode
resource.connectionDraining
- resource.connectionDraining.drainingTimeoutSec
resource.connectionTrackingPolicy
- resource.connectionTrackingPolicy.connectionPersistenceOnUnhealthyBackends
- resource.connectionTrackingPolicy.enableStrongAffinity
- resource.connectionTrackingPolicy.idleTimeoutSec
- resource.connectionTrackingPolicy.trackingMode
resource.consistentHash
- resource.consistentHash.httpCookie
- resource.consistentHash.httpCookie.name
- resource.consistentHash.httpCookie.path
- resource.consistentHash.httpCookie.ttl
  - resource.consistentHash.httpCookie.ttl.nanos
  - resource.consistentHash.httpCookie.ttl.seconds
- resource.consistentHash.minimumRingSize
resource.customRequestHeaders
resource.customResponseHeaders
resource.affinityCookieTtlSec
resource.failoverPolicy
- resource.failoverPolicy.disableConnectionDrainOnFailover
- resource.failoverPolicy.dropTrafficIfUnhealthy
- resource.failoverPolicy.failoverRatio
resource.iap
- resource.iap.enabled
- resource.iap.oauth2ClientId
resource.ipAddressSelectionPolicy
resource.loadBalancingScheme
resource.localityLbPolicies
- resource.localityLbPolicies.customPolicy
- resource.localityLbPolicies.customPolicy.data
- resource.localityLbPolicies.customPolicy.name
- resource.localityLbPolicies.policy
- resource.localityLbPolicies.policy.name
resource.logConfig
- resource.logConfig.enable
- resource.logConfig.optionalFields
- resource.logConfig.optionalMode
- resource.logConfig.sampleRate
resource.maxStreamDuration
- resource.maxStreamDuration.nanos
- resource.maxStreamDuration.seconds
resource.outlierDetection
- resource.outlierDetection.baseEjectionTime
- resource.outlierDetection.baseEjectionTime.nanos
- resource.outlierDetection.baseEjectionTime.seconds
- resource.outlierDetection.consecutiveGatewayFailure
- resource.outlierDetection.enforcingConsecutiveErrors
- resource.outlierDetection.enforcingConsecutiveGatewayFailure
- resource.outlierDetection.enforcingSuccessRate
- resource.outlierDetection.maxEjectionPercent
- resource.outlierDetection.successRateMinimumHosts
- resource.outlierDetection.successRateRequestVolume
- resource.outlierDetection.successRateStdevFactor
resource.securitySettings
- resource.securitySettings.awsV4Authentication
- resource.securitySettings.awsV4Authentication.accessKeyId
- resource.securitySettings.awsV4Authentication.accessKeyVersion
- resource.securitySettings.subjectAltNames
resource.sessionAffinity
resource.subsetting
- resource.subsetting.policy
resource.timeoutSec
resource.strongSessionAffinityCookie
- resource.strongSessionAffinityCookie.name
- resource.strongSessionAffinityCookie.path
- resource.strongSessionAffinityCookie.ttl
- resource.strongSessionAffinityCookie.ttl.nanos
- resource.strongSessionAffinityCookie.ttl.seconds

轉送規則

轉送規則：compute.googleapis.com/ForwardingRule

resource.name
resource.description
resource.allowGlobalAccess
resource.allowPscGlobalAccess
resource.allPorts
resource.IPProtocol
resource.ipVersion
resource.isMirroringCollector
resource.loadBalancingScheme
resource.metadataFilters
- resource.metadataFilters.filterLabels
- resource.metadataFilters.filterLabels.name
- resource.metadataFilters.filterLabels.value
- resource.metadataFilters.filterMatchCriteria
resource.networkTier
resource.noAutomateDnsZone
resource.portRange
resource.ports
resource.serviceDirectoryRegistrations
- resource.serviceDirectoryRegistrations.namespace
- resource.serviceDirectoryRegistrations.service
- resource.serviceDirectoryRegistrations.serviceDirectoryRegion
resource.serviceLabel
resource.sourceIpRanges

健康狀態檢查

健康狀態檢查：compute.googleapis.com/HealthCheck

resource.name
resource.description
resource.checkIntervalSec
resource.timeoutSec
resource.unhealthyThreshold
resource.healthyThreshold
resource.type
TCP 健康狀態檢查：
- resource.tcpHealthCheck.port
- resource.tcpHealthCheck.request
- resource.tcpHealthCheck.response
- resource.tcpHealthCheck.proxyHeader
- resource.tcpHealthCheck.portSpecification
SSL 健康狀態檢查：
- resource.sslHealthCheck.port
- resource.sslHealthCheck.request
- resource.sslHealthCheck.response
- resource.sslHealthCheck.proxyHeader
- resource.sslHealthCheck.portSpecification
HTTP 健康狀態檢查：
- resource.httpHealthCheck.port
- resource.httpHealthCheck.host
- resource.httpHealthCheck.requestPath
- resource.httpHealthCheck.proxyHeader
- resource.httpHealthCheck.response
- resource.httpHealthCheck.portSpecification
HTTPS 健康狀態檢查：
- resource.httpsHealthCheck.port
- resource.httpsHealthCheck.host
- resource.httpsHealthCheck.requestPath
- resource.httpsHealthCheck.proxyHeader
- resource.httpsHealthCheck.response
- resource.httpsHealthCheck.portSpecification
HTTP/2 健康狀態檢查：
- resource.http2HealthCheck.port
- resource.http2HealthCheck.host
- resource.http2HealthCheck.requestPath
- resource.http2HealthCheck.proxyHeader
- resource.http2HealthCheck.response
- resource.http2HealthCheck.portSpecification
gRPC 健康狀態檢查：
- resource.grpcHealthCheck.port
- resource.grpcHealthCheck.grpcServiceName
- resource.grpcHealthCheck.portSpecification
resource.sourceRegions
resource.logConfig
- resource.logConfig.enable

網路端點群組

網路端點群組：compute.googleapis.com/NetworkEndpointGroup

resource.annotations
resource.appEngine.service
resource.appEngine.urlMask
resource.appEngine.version
resource.cloudFunction.function
resource.cloudFunction.urlMask
resource.cloudRun.service
resource.cloudRun.tag
resource.cloudRun.urlMask
resource.defaultPort
resource.description
resource.name
resource.network
resource.networkEndpointType
resource.pscData.producerPort
resource.pscTargetService
resource.subnetwork

服務負載平衡政策

服務負載平衡政策：networkservices.googleapis.com/ServiceLbPolicy

resource.autoCapacityDrain.enable
resource.description
resource.failoverConfig.failoverHealthThreshold
resource.loadBalancingAlgorithm
resource.name

安全資料傳輸層 (SSL) 政策

SSL 政策：compute.googleapis.com/SslPolicy

resource.profile
resource.name
resource.description
resource.minTlsVersion
resource.customFeatures

目標執行個體

目標執行個體：compute.googleapis.com/TargetInstance

resource.name
resource.description
resource.natPolicy

目標集區

目標集區：compute.googleapis.com/TargetPool

resource.name
resource.description
resource.sessionAffinity
resource.failoverRatio

目標 Proxy

目標 TCP Proxy：compute.googleapis.com/TargetTcpProxy

resource.name
resource.description
resource.proxyBind
resource.proxyHeader

目標 SSL Proxy：compute.googleapis.com/TargetSslProxy

resource.name
resource.description
resource.proxyHeader

目標 HTTP Proxy：compute.googleapis.com/TargetHttpProxy

resource.name
resource.description
resource.proxyBind
resource.httpKeepAliveTimeoutSec

目標 HTTPS Proxy 伺服器：compute.googleapis.com/TargetHttpsProxy

resource.name
resource.description
resource.proxyBind
resource.httpKeepAliveTimeoutSec
resource.quicOverride
resource.tlsEarlyData

目標 gRPC 代理伺服器：compute.googleapis.com/TargetGrpcProxy

resource.name
resource.description
resource.validateForProxyless

網址對應

網址對應：compute.googleapis.com/UrlMap

resource.name
resource.description
resource.defaultCustomErrorResponsePolicy
- resource.defaultCustomErrorResponsePolicy.errorResponseRules
  - resource.defaultCustomErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.defaultCustomErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.defaultCustomErrorResponsePolicy.errorResponseRules.path
resource.defaultRouteAction
- resource.defaultRouteAction.corsPolicy
- resource.defaultRouteAction.corsPolicy.allowCredentials
- resource.defaultRouteAction.corsPolicy.allowHeaders
- resource.defaultRouteAction.corsPolicy.allowMethods
- resource.defaultRouteAction.corsPolicy.allowOrigins
- resource.defaultRouteAction.corsPolicy.allowOriginRegexes
- resource.defaultRouteAction.corsPolicy.disabled
- resource.defaultRouteAction.corsPolicy.exposeHeaders
- resource.defaultRouteAction.corsPolicy.maxAge
- resource.defaultRouteAction.faultInjectionPolicy
- resource.defaultRouteAction.faultInjectionPolicy.abort
  - resource.defaultRouteAction.faultInjectionPolicy.abort.httpStatus
  - resource.defaultRouteAction.faultInjectionPolicy.abort.percentage
- resource.defaultRouteAction.faultInjectionPolicy.delay
  - resource.defaultRouteAction.faultInjectionPolicy.delay.percentage
  - resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay
  - resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.nanos
  - resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.seconds
- resource.defaultRouteAction.maxStreamDuration
- resource.defaultRouteAction.maxStreamDuration.nanos
- resource.defaultRouteAction.maxStreamDuration.seconds
- resource.defaultRouteAction.requestMirrorPolicy
- resource.defaultRouteAction.retryPolicy
- resource.defaultRouteAction.retryPolicy.numRetries
- resource.defaultRouteAction.retryPolicy.perTryTimeout
  - resource.defaultRouteAction.retryPolicy.perTryTimeout.nanos
  - resource.defaultRouteAction.retryPolicy.perTryTimeout.seconds
- resource.defaultRouteAction.retryPolicy.retryConditions
- resource.defaultRouteAction.timeout
- resource.defaultRouteAction.timeout.nanos
- resource.defaultRouteAction.timeout.seconds
- resource.defaultRouteAction.urlRewrite
- resource.defaultRouteAction.urlRewrite.hostRewrite
- resource.defaultRouteAction.urlRewrite.pathPrefixRewrite
- resource.defaultRouteAction.urlRewrite.pathTemplateRewrite
- resource.defaultRouteAction.weightedBackendServices
- resource.defaultRouteAction.weightedBackendServices.headerAction
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
  - resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToRemove
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
  - resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToRemove
- resource.defaultRouteAction.weightedBackendServices.weight
resource.defaultUrlRedirect
- resource.defaultUrlRedirect.hostRedirect
- resource.defaultUrlRedirect.httpsRedirect
- resource.defaultUrlRedirect.pathRedirect
- resource.defaultUrlRedirect.prefixRedirect
- resource.defaultUrlRedirect.redirectResponseCode
- resource.defaultUrlRedirect.stripQuery
resource.headerAction
- resource.headerAction.requestHeadersToAdd
- resource.headerAction.requestHeadersToAdd.headerName
- resource.headerAction.requestHeadersToAdd.headerValue
- resource.headerAction.requestHeadersToAdd.replace
- resource.headerAction.requestHeadersToRemove
- resource.headerAction.responseHeadersToAdd
- resource.headerAction.responseHeadersToAdd.headerName
- resource.headerAction.responseHeadersToAdd.headerValue
- resource.headerAction.responseHeadersToAdd.replace
- resource.headerAction.responseHeadersToRemove
resource.hostRules
- resource.hostRules.description
- resource.hostRules.hosts
- resource.hostRules.pathMatcher
resource.pathMatchers
- resource.pathMatchers.name
- resource.pathMatchers.description
- resource.pathMatchers.defaultCustomErrorResponsePolicy
- resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules
  - resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.path
- resource.pathMatchers.defaultRouteAction
- resource.pathMatchers.defaultRouteAction.corsPolicy
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowCredentials
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowHeaders
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowMethods
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowOrigins
  - resource.pathMatchers.defaultRouteAction.corsPolicy.allowOriginRegexes
  - resource.pathMatchers.defaultRouteAction.corsPolicy.disabled
  - resource.pathMatchers.defaultRouteAction.corsPolicy.exposeHeaders
  - resource.pathMatchers.defaultRouteAction.corsPolicy.maxAge
- resource.pathMatchers.defaultRouteAction.faultInjectionPolicy
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort.httpStatus
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort.percentage
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.percentage
  - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay
    - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.nanos
    - resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.seconds
- resource.pathMatchers.defaultRouteAction.maxStreamDuration
  - resource.pathMatchers.defaultRouteAction.maxStreamDuration.nanos
  - resource.pathMatchers.defaultRouteAction.maxStreamDuration.seconds
- resource.pathMatchers.defaultRouteAction.requestMirrorPolicy
- resource.pathMatchers.defaultRouteAction.retryPolicy
  - resource.pathMatchers.defaultRouteAction.retryPolicy.numRetries
  - resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout
  - resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout.nanos
  - resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout.seconds
  - resource.pathMatchers.defaultRouteAction.retryPolicy.retryConditions
- resource.pathMatchers.defaultRouteAction.timeout
  - resource.pathMatchers.defaultRouteAction.timeout.nanos
  - resource.pathMatchers.defaultRouteAction.timeout.seconds
- resource.pathMatchers.defaultRouteAction.urlRewrite
  - resource.pathMatchers.defaultRouteAction.urlRewrite.hostRewrite
  - resource.pathMatchers.defaultRouteAction.urlRewrite.pathPrefixRewrite
  - resource.pathMatchers.defaultRouteAction.urlRewrite.pathTemplateRewrite
- resource.pathMatchers.defaultRouteAction.weightedBackendServices
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToRemove
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
    - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToRemove
  - resource.pathMatchers.defaultRouteAction.weightedBackendServices.weight
- resource.pathMatchers.defaultUrlRedirect
- resource.pathMatchers.defaultUrlRedirect.hostRedirect
- resource.pathMatchers.defaultUrlRedirect.httpsRedirect
- resource.pathMatchers.defaultUrlRedirect.pathRedirect
- resource.pathMatchers.defaultUrlRedirect.prefixRedirect
- resource.pathMatchers.defaultUrlRedirect.redirectResponseCode
- resource.pathMatchers.defaultUrlRedirect.stripQuery
- resource.pathMatchers.headerAction
- resource.pathMatchers.headerAction.requestHeadersToAdd
- resource.pathMatchers.headerAction.requestHeadersToAdd.headerName
- resource.pathMatchers.headerAction.requestHeadersToAdd.headerValue
- resource.pathMatchers.headerAction.requestHeadersToAdd.replace
- resource.pathMatchers.headerAction.requestHeadersToRemove
- resource.pathMatchers.headerAction.responseHeadersToAdd
- resource.pathMatchers.headerAction.responseHeadersToAdd.headerName
- resource.pathMatchers.headerAction.responseHeadersToAdd.headerValue
- resource.pathMatchers.headerAction.responseHeadersToAdd.replace
- resource.pathMatchers.headerAction.responseHeadersToRemove
- resource.pathMatchers.pathRules
- resource.pathMatchers.pathRules.paths
- resource.pathMatchers.pathRules.customErrorResponsePolicy
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.path
- resource.pathMatchers.pathRules.routeAction
  - resource.pathMatchers.pathRules.routeAction.corsPolicy
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowCredentials
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowHeaders
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowMethods
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowOrigins
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.allowOriginRegexes
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.disabled
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.exposeHeaders
  - resource.pathMatchers.pathRules.routeAction.corsPolicy.maxAge
  - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy
  - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort.httpStatus
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort.percentage
  - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.percentage
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay.nanos
    - resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay.seconds
  - resource.pathMatchers.pathRules.routeAction.maxStreamDuration
  - resource.pathMatchers.pathRules.routeAction.maxStreamDuration.nanos
  - resource.pathMatchers.pathRules.routeAction.maxStreamDuration.seconds
  - resource.pathMatchers.pathRules.routeAction.requestMirrorPolicy
  - resource.pathMatchers.pathRules.routeAction.retryPolicy
  - resource.pathMatchers.pathRules.routeAction.retryPolicy.numRetries
  - resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout
    - resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout.nanos
    - resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout.seconds
  - resource.pathMatchers.pathRules.routeAction.retryPolicy.retryConditions
  - resource.pathMatchers.pathRules.routeAction.timeout
  - resource.pathMatchers.pathRules.routeAction.timeout.nanos
  - resource.pathMatchers.pathRules.routeAction.timeout.seconds
  - resource.pathMatchers.pathRules.routeAction.urlRewrite
  - resource.pathMatchers.pathRules.routeAction.urlRewrite.hostRewrite
  - resource.pathMatchers.pathRules.routeAction.urlRewrite.pathPrefixRewrite
  - resource.pathMatchers.pathRules.routeAction.urlRewrite.pathTemplateRewrite
  - resource.pathMatchers.pathRules.routeAction.weightedBackendServices
  - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToRemove
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
    - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToRemove
  - resource.pathMatchers.pathRules.routeAction.weightedBackendServices.weight
- resource.pathMatchers.pathRules.urlRedirect
  - resource.pathMatchers.pathRules.urlRedirect.hostRedirect
  - resource.pathMatchers.pathRules.urlRedirect.httpsRedirect
  - resource.pathMatchers.pathRules.urlRedirect.pathRedirect
  - resource.pathMatchers.pathRules.urlRedirect.prefixRedirect
  - resource.pathMatchers.pathRules.urlRedirect.redirectResponseCode
  - resource.pathMatchers.pathRules.urlRedirect.stripQuery
- resource.pathMatchers.routeRules
- resource.pathMatchers.routeRules.description
- resource.pathMatchers.routeRules.priority
- resource.pathMatchers.routeRules.customErrorResponsePolicy
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.matchResponseCodes
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.overrideResponseCode
  - resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.path
- resource.pathMatchers.routeRules.headerAction
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.headerName
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.headerValue
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.replace
  - resource.pathMatchers.routeRules.headerAction.requestHeadersToRemove
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.headerName
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.headerValue
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.replace
  - resource.pathMatchers.routeRules.headerAction.responseHeadersToRemove
- resource.pathMatchers.routeRules.matchRules
  - resource.pathMatchers.routeRules.matchRules.fullPathMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches
  - resource.pathMatchers.routeRules.matchRules.headerMatches.exactMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.headerName
  - resource.pathMatchers.routeRules.matchRules.headerMatches.invertMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.prefixMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.presentMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch
    - resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch.rangeStart
    - resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch.rangeEnd
  - resource.pathMatchers.routeRules.matchRules.headerMatches.regexMatch
  - resource.pathMatchers.routeRules.matchRules.headerMatches.suffixMatch
  - resource.pathMatchers.routeRules.matchRules.ignoreCase
  - resource.pathMatchers.routeRules.matchRules.metadataFilters
  - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels
    - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels.name
    - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels.value
  - resource.pathMatchers.routeRules.matchRules.metadataFilters.filterMatchCriteria
  - resource.pathMatchers.routeRules.matchRules.pathTemplateMatch
  - resource.pathMatchers.routeRules.matchRules.prefixMatch
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.name
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.exactMatch
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.presentMatch
  - resource.pathMatchers.routeRules.matchRules.queryParameterMatches.regexMatch
  - resource.pathMatchers.routeRules.matchRules.regexMatch
- resource.pathMatchers.routeRules.routeAction
  - resource.pathMatchers.routeRules.routeAction.corsPolicy
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowCredentials
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowHeaders
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowMethods
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowOrigins
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.allowOriginRegexes
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.disabled
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.exposeHeaders
  - resource.pathMatchers.routeRules.routeAction.corsPolicy.maxAge
  - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy
  - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort.httpStatus
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort.percentage
  - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.percentage
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay.nanos
    - resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay.seconds
  - resource.pathMatchers.routeRules.routeAction.maxStreamDuration
  - resource.pathMatchers.routeRules.routeAction.maxStreamDuration.nanos
  - resource.pathMatchers.routeRules.routeAction.maxStreamDuration.seconds
  - resource.pathMatchers.routeRules.routeAction.requestMirrorPolicy
  - resource.pathMatchers.routeRules.routeAction.retryPolicy
  - resource.pathMatchers.routeRules.routeAction.retryPolicy.numRetries
  - resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout
    - resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout.nanos
    - resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout.seconds
  - resource.pathMatchers.routeRules.routeAction.retryPolicy.retryConditions
  - resource.pathMatchers.routeRules.routeAction.timeout
  - resource.pathMatchers.routeRules.routeAction.timeout.nanos
  - resource.pathMatchers.routeRules.routeAction.timeout.seconds
  - resource.pathMatchers.routeRules.routeAction.urlRewrite
  - resource.pathMatchers.routeRules.routeAction.urlRewrite.hostRewrite
  - resource.pathMatchers.routeRules.routeAction.urlRewrite.pathPrefixRewrite
  - resource.pathMatchers.routeRules.routeAction.urlRewrite.pathTemplateRewrite
  - resource.pathMatchers.routeRules.routeAction.weightedBackendServices
  - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToRemove
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
    - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToRemove
  - resource.pathMatchers.routeRules.routeAction.weightedBackendServices.weight
- resource.pathMatchers.routeRules.urlRedirect
  - resource.pathMatchers.routeRules.urlRedirect.hostRedirect
  - resource.pathMatchers.routeRules.urlRedirect.httpsRedirect
  - resource.pathMatchers.routeRules.urlRedirect.pathRedirect
  - resource.pathMatchers.routeRules.urlRedirect.prefixRedirect
  - resource.pathMatchers.routeRules.urlRedirect.redirectResponseCode
  - resource.pathMatchers.routeRules.urlRedirect.stripQuery
resource.tests
- resource.tests.description
- resource.tests.expectedOutputUrl
- resource.tests.expectedRedirectResponseCode
- resource.tests.headers
- resource.tests.headers.name
- resource.tests.headers.value
- resource.tests.host
- resource.tests.path

如需其他支援的運算資源，請參閱 Compute Engine 自訂限制頁面。

政策繼承

根據預設，機構政策會由您強制執行政策的資源子項繼承。舉例來說，如果您對資料夾套用政策， Google Cloud 就會對資料夾中的所有專案套用政策。如要進一步瞭解這項行為和如何變更，請參閱「階層評估規則」。

事前準備

如果尚未設定，請先設定驗證機制。驗證是指驗證身分，以便存取 Google Cloud 服務和 API 的程序。如要從本機開發環境執行程式碼或範例，請選取下列任一選項，以便驗證 Compute Engine：

Select the tab for how you plan to use the samples on this page:
Console

When you use the Google Cloud console to access Google Cloud services and APIs, you don't need to set up authentication.
gcloud

請務必確認您知道自己的機構 ID。

必要的角色

如要取得管理 Cloud Load Balancing 資源機構政策所需的權限，請要求管理員授予下列 IAM 角色：

機構資源_types 中的機構政策管理員 (roles/orgpolicy.policyAdmin)
如要測試負載平衡資源的限制條件，請按照下列步驟操作： Compute 負載平衡器管理員 (v1) (roles/compute.loadBalancerAdmin.v1) 在專案資源上

如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和機構的存取權」。

這些預先定義的角色包含管理 Cloud Load Balancing 資源的機構政策所需的權限。如要查看確切的必要權限，請展開「必要權限」部分：

所需權限

必須具備下列權限，才能管理 Cloud Load Balancing 資源的組織政策：

orgpolicy.constraints.list
orgpolicy.policies.create
orgpolicy.policies.delete
orgpolicy.policies.list
orgpolicy.policies.update
orgpolicy.policy.get
orgpolicy.policy.set

您或許還可透過自訂角色或其他預先定義的角色取得這些權限。

設定自訂限制

自訂限制是由您要強制執行機構政策的服務支援的資源、方法、條件和動作所定義。您可以使用一般運算語言 (CEL) 定義自訂限制條件。如要進一步瞭解如何使用 CEL 在自訂限制中建立條件，請參閱「建立及管理自訂機構政策」一文中的 CEL 相關部分。

您可以使用 Google Cloud 主控台或 gcloud CLI 建立自訂限制，並設定用於機構政策。

控制台

在 Google Cloud 控制台中，前往「Organization policies」(機構政策) 頁面。

前往「機構政策」
選取頁面頂端的專案挑選器。
在「Select a resource」視窗中，選取要建立自訂限制的機構。
按一下「自訂限制」。
在「顯示名稱」方塊中，輸入限制的易懂名稱。這個欄位的長度上限為 200 個半形字元。請勿在限制名稱中使用 PII 或機密資料，因為錯誤訊息可能會顯示上述資訊。
在「Constraint ID」方塊中，輸入新自訂限制條件的名稱。自訂限制的開頭必須為 custom.，且只能包含大寫英文字母、小寫英文字母或數字，例如 custom.enforceTCPHealthCheckPort1024。這個欄位的長度上限為 70 個半形字元，不含前置字元 (例如 organizations/123456789/customConstraints/custom.)。
在「說明」方塊中，輸入限制的易讀說明，以便在違反政策時顯示為錯誤訊息。這個欄位的長度上限為 2000 個半形字元。
在「Resource type」方塊中，選取包含要限制的物件和欄位的 Google CloudREST 資源名稱。例如：compute.googleapis.com/HealthCheck。
在「強制執行方法」下方，選取是否要在 REST CREATE 方法上強制執行限制。
如要定義條件，請按一下 編輯條件。
1. 在「Add condition」面板中，建立參照支援的服務資源 (例如 resource.tcpHealthCheck.port >= 1024) 的 CEL 條件。這個欄位的長度上限為 1000 個半形字元。
2. 按一下 [儲存]。
在「動作」下方，選取在符合上述條件時，要允許或拒絕評估方法。
按一下「建立限制條件」。

在每個欄位中輸入值後，這個自訂限制的對等 YAML 設定會顯示在右側。

gcloud

如要使用 gcloud CLI 建立自訂限制，請為自訂限制建立 YAML 檔案：

name: organizations/ORGANIZATION_ID/customConstraints/CONSTRAINT_NAME
resource_types:
- compute.googleapis.com/RESOURCE_NAME
method_types:
- CREATE
- UPDATE
condition: CONDITION
action_type: ACTION
display_name: DISPLAY_NAME
description: DESCRIPTION

更改下列內容：

ORGANIZATION_ID：貴機構 ID，例如 123456789。
CONSTRAINT_NAME：您要為新自訂限制設定的名稱。自訂限制的開頭必須為 custom.，且只能包含大寫英文字母、小寫英文字母或數字。例如，custom.enforceTCPHealthCheckPort1024。這個欄位的長度上限為 70 個半形字元，不含前置字元 (例如 organizations/123456789/customConstraints/custom.)。
RESOURCE_NAME：包含您要限制的物件和欄位的 Compute Engine API REST 資源名稱 (而非 URI)。例如：HealthCheck。
CONDITION：針對支援的服務資源表示法編寫的 CEL 條件。這個欄位的長度上限為 1000 個半形字元。如要進一步瞭解可用於寫入條件的資源，請參閱「支援的資源」。例如："resource.tcpHealthCheck.port >= 1024"。
ACTION：如果符合 condition，則採取的動作。這個欄位可以是 ALLOW 或 DENY。
DISPLAY_NAME：限制的易讀名稱。這個欄位的長度上限為 200 個半形字元。
DESCRIPTION：在違反政策時，要以錯誤訊息形式顯示的限制說明。這個欄位的長度上限為 2000 個半形字元。

如要進一步瞭解如何建立自訂限制，請參閱「建立及管理自訂機構政策」。

為新自訂限制建立 YAML 檔案後，您必須設定該檔案，以便在貴機構中使用機構政策。如要設定自訂限制條件，請使用 gcloud org-policies set-custom-constraint 指令：

gcloud org-policies set-custom-constraint CONSTRAINT_PATH

將 CONSTRAINT_PATH 替換為自訂限制檔案的完整路徑。例如：/home/user/customconstraint.yaml。完成後，自訂限制就會列在 Google Cloud 機構政策清單中，成為機構政策。如要確認自訂限制是否存在，請使用 gcloud org-policies list-custom-constraints 指令：

gcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID

將 ORGANIZATION_ID 替換為機構資源的 ID。詳情請參閱「查看組織政策」。

強制執行自訂限制

您可以建立參照限制的機構政策，然後將該機構政策套用至 Google Cloud 資源，藉此強制執行限制。

控制台

在 Google Cloud 控制台中，前往「Organization policies」(機構政策) 頁面。
前往「機構政策」
在專案選擇工具中，選取要設定機構政策的專案。
在「Organization policies」頁面的清單中選取限制條件，即可查看該限制條件的「Policy details」頁面。
如要設定這項資源的機構政策，請按一下「管理政策」。
在「Edit policy」(編輯政策) 頁面上，選取「Override parent's policy」(覆寫父項政策)。
按一下「新增規則」。
在「Enforcement」(強制執行) 部分，選取是否要啟用這項機構政策的強制執行機制。
選用：如要讓機構政策依標記而定，請按一下「新增條件」。請注意，如果您在組織政策中新增條件規則，則必須至少新增一項無條件規則，否則無法儲存政策。詳情請參閱「設定含有標記的組織政策」。
按一下「測試變更」，模擬機構政策的效果。舊版受管理限制條件無法進行政策模擬。詳情請參閱「使用 Policy Simulator 測試組織政策變更」。
如要完成並套用機構政策，請按一下「設定政策」。這項政策最多需要 15 分鐘才會生效。

gcloud

如要建立包含布林值規則的機構政策，請建立參照限制的政策 YAML 檔案：

      name: projects/PROJECT_ID/policies/CONSTRAINT_NAME
      spec:
        rules:
        - enforce: true

取代下列內容：

PROJECT_ID：您要強制執行限制的專案。
CONSTRAINT_NAME：您為自訂限制定義的名稱。例如：custom.enforceTCPHealthCheckPort1024。

如要強制執行包含限制的機構政策，請執行下列指令：

    gcloud org-policies set-policy POLICY_PATH

將 POLICY_PATH 替換為機構政策 YAML 檔案的完整路徑。這項政策最多需要 15 分鐘才會生效。

範例：使用自訂限制來限制 TLS 功能

如要使用自訂限制來限制支援的負載平衡器的 TLS 功能，請在貴機構中定義使用預先定義 constraints/compute.requireSslPolicy 限制的政策。定義政策後，請按照下列步驟設定及使用自訂限制條件。

為預先定義的限制建立 YAML 檔案。

name: organizations/ORGANIZATION_ID/customConstraints/custom.CONSTRAINT_NAME
resource_types: compute.googleapis.com/SslPolicy
methodTypes:
- CREATE
- UPDATE
condition: resource.FIELD_NAME == VALUE
action_type: ACTION
display_name: DISPLAY_NAME
description: DESCRIPTION

以下範例會將最低傳輸層安全標準 (TLS) 版本限制為 1.2：

name: organizations/012345678901/customConstraints/custom.restrictLbTlsVersion
resource_types: compute.googleapis.com/SslPolicy
methodTypes:
- CREATE
- UPDATE
condition: resource.minTlsVersion == "TLS_1_2"
action_type: ALLOW
display_name: Restrict Load Balancing TLS version to 1.2
description: Only allow SSL policies to be created or updated if the minimum TLS version is 1.2 where this custom constraint is enforced.

以下是另一個自訂限制的範例，只有在符合下列條件時，才允許建立 SSL 資源：

最低 TLS 版本設為 1.2。
SSL 政策包含 CUSTOM 設定檔，可讓您個別選取 SSL 功能。
SSL 政策不包含 ChaCha20-Poly1305 加密組合。

name: organizations/ORGANIZATION_ID/customConstraints/custom.restrictLbTlsCapabilities
resourceTypes:
- compute.googleapis.com/SslPolicy
methodTypes:
- CREATE
- UPDATE
condition: resource.minTlsVersion == "TLS_1_2" && resource.profile ==
"CUSTOM" && !resource.customFeatures.exists(feature, feature.contains("CHACHA20_POLY1305"))
actionType: ALLOW
displayName: Restrict Load Balancing TLS Capabilities
description: Only allow SSL Policy resources to be created or updated if the minimum TLS version is 1.2, profile is CUSTOM, and no ChaCha20-Poly1305 cipher suite is used where this custom constraint is enforced.

將自訂限制新增至貴機構。

gcloud org-policies set-custom-constraint PATH_TO_FILE

確認貴機構中有自訂限制。

gcloud org-policies list-custom-constraints \
    --organization=ORGANIZATION_ID

建立限制的政策檔案。
```
name: projects/PROJECT_ID/policies/custom.CONSTRAINT_NAME
spec:
  rules:
  – enforce: true
```
更改下列內容：
- PROJECT_ID：您的 Google Cloud 專案 ID
- CONSTRAINT_NAME：限制名稱
強制執行政策。
```
gcloud org-policies set-policy PATH_TO_POLICY_FILE
```
將 PATH_TO_POLICY_FILE 替換為政策檔案的完整路徑。

假設您已建立 YAML 檔案，將最低 TLS 版本限制為 1.2，請建立 SSL 政策並將 minTlsVersion 設為 TLS_1_0，以便測試限制條件：

gcloud compute ssl-policies create SSL_POLICY_NAME \
    --min-tls-version=1.0 \
    --project=PROJECT_ID

輸出結果會與下列內容相似：

ERROR: (gcloud.compute.ssl-policies.update) HTTPError 412: Operation
denied by custom org policy: [customConstraints/custom.
restrictLbTlsVersion] : Only allow SSL policy resources to be created or
updated if the minimum TLS version is 1.2 where this custom constraint
is enforced.

範例：建立限制，將 TCP 健康狀態檢查通訊埠限制為至少 1024

以下範例會建立自訂限制和政策，將 TCP 健康狀態檢查通訊埠編號限制為至少 1024。

開始之前，請先瞭解下列事項：

您的機構 ID
專案 ID

gcloud

建立包含下列資訊的 enforceTCPHealthCheckPort1024.yaml 限制檔案：

name: organizations/ORGANIZATION_ID/customConstraints/custom.enforceTCPHealthCheckPort1024
resource_types:
– compute.googleapis.com/HealthCheck
condition: "resource.tcpHealthCheck.port >= 1024"
method_types:
– CREATE
– UPDATE
action_type: ALLOW
display_name: Only TCP HealthCheck Port >= 1024 Allowed.
description: Prevent TCP health checks on well-known ports.

設定自訂限制。

gcloud org-policies set-custom-constraint enforceTCPHealthCheckPort1024.yaml

請使用以下資訊建立 enforceTCPHealthCheckPort1024-policy.yaml 政策檔案。在這個範例中，我們會在專案層級強制執行這項限制，但您也可以在機構或資料夾層級設定這項限制。將 PROJECT_ID 替換為您的專案 ID。
```
name: projects/PROJECT_ID/policies/custom.enforceTCPHealthCheckPort1024
spec:
  rules:
  – enforce: true
```

強制執行政策。

gcloud org-policies set-policy enforceTCPHealthCheckPort1024-policy.yaml

嘗試在禁止的通訊埠 80 上建立 TCP 健康狀態檢查，以測試限制。

gcloud compute health-checks create tcp my-tcp-health-check \
    --project=PROJECT_ID \
    --region=us-central1 \
    --port=80 \
    --check-interval=5s \
    --timeout=5s \
    --healthy-threshold=4 \
    --unhealthy-threshold=5 \

輸出結果會與下列內容相似：

ERROR: (gcloud.compute.healthChecks.create) Could not fetch resource:
– Operation denied by custom org policies: [customConstraints/custom.enforceTCPHealthCheckPort1024]: Only TCP HealthCheck Port >= 1024 Allowed.

常見用途的更多範例

以下各節將提供一些實用的自訂限制語法：

後端值區

用途	語法
要求所有後端值區都啟用 Cloud CDN	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.backendBucketEnableCdn resourceTypes: - compute.googleapis.com/BackendBucket methodTypes: - CREATE - UPDATE condition: "resource.enableCdn == true" actionType: ALLOW displayName: Require all backend buckets to have Cloud CDN enabled description: All backend buckets must have Cloud CDN enabled.

用途

語法

要求所有後端值區都啟用 Cloud CDN

name: organizations/ORGANIZATION_ID/customConstraints/custom.backendBucketEnableCdn
resourceTypes:
- compute.googleapis.com/BackendBucket
methodTypes:
- CREATE
- UPDATE
condition: "resource.enableCdn == true"
actionType: ALLOW
displayName: Require all backend buckets to have Cloud CDN enabled
description: All backend buckets must have Cloud CDN enabled.

後端服務

用途	語法
禁止使用 HTTP 和 TCP 做為後端服務通訊協定	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.backendBucketEnableCdn resourceTypes: - compute.googleapis.com/BackendService methodTypes: - CREATE - UPDATE condition: "resource.serviceProtocol == 'HTTP' \|\| resource.serviceProtocol == 'TCP'" actionType: DENY displayName: Disallow the use of HTTP and TCP as backend service protocols description: Backend services cannot configure HTTP or TCP as the backend service protocol.

用途

語法

禁止使用 HTTP 和 TCP 做為後端服務通訊協定

name: organizations/ORGANIZATION_ID/customConstraints/custom.backendBucketEnableCdn
resourceTypes:
- compute.googleapis.com/BackendService
methodTypes:
- CREATE
- UPDATE
condition: "resource.serviceProtocol == 'HTTP' || resource.serviceProtocol == 'TCP'"
actionType: DENY
displayName: Disallow the use of HTTP and TCP as backend service protocols
description: Backend services cannot configure HTTP or TCP as the backend service protocol.

轉送規則

用途	語法
要求轉送規則才能使用標準級	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.forwardingRulesStandardTier resourceTypes: - compute.googleapis.com/ForwardingRule methodTypes: - CREATE - UPDATE condition: "resource.networkTier == 'STANDARD'" actionType: ALLOW displayName: Require forwarding rules to use Standard Tier description: Forwarding rules must use the Standard Network Service Tier.

用途

語法

要求轉送規則才能使用標準級

name: organizations/ORGANIZATION_ID/customConstraints/custom.forwardingRulesStandardTier
resourceTypes:
- compute.googleapis.com/ForwardingRule
methodTypes:
- CREATE
- UPDATE
condition: "resource.networkTier == 'STANDARD'"
actionType: ALLOW
displayName: Require forwarding rules to use Standard Tier
description: Forwarding rules must use the Standard Network Service Tier.

健康狀態檢查

用途	語法
要求所有健康狀態檢查通訊協定都必須在 1024 以上通訊埠上執行	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.healthCheckPortMin1024 resourceTypes: - compute.googleapis.com/HealthCheck methodTypes: - CREATE - UPDATE condition: "resource.tcpHealthCheck.port >= 1024 && resource.httpHealthCheck.port >= 1024 && resource.httpsHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 &&resource.http2HealthCheck.port >= 1024 && resource.grpcHealthCheck.port >= 1024" actionType: ALLOW displayName: Require port 1024 or greater for all health checks description: All health check protocols must use a port of 1024 or higher, to avoid well-known ports.
禁止 GRPC 健康狀態檢查	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.disallowGRPCHealthChecks resourceTypes: - compute.googleapis.com/HealthCheck methodTypes: - CREATE - UPDATE condition: "resource.type == 'GRPC'" actionType: DENY displayName: Disallow GRPC health checks description: Health checks aren't allowed to use GRPC.
避免頻繁的健康狀態檢查探測要求	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.minHealthCheckFrequency resourceTypes: - compute.googleapis.com/HealthCheck methodTypes: - CREATE - UPDATE condition: "resource.checkIntervalSec >= 30" actionType: ALLOW displayName: Disallow fast health check probes description: Prevent health checks from having a probe frequency under 30 seconds.

用途

語法

要求所有健康狀態檢查通訊協定都必須在 1024 以上通訊埠上執行

name: organizations/ORGANIZATION_ID/customConstraints/custom.healthCheckPortMin1024
resourceTypes:
- compute.googleapis.com/HealthCheck
methodTypes:
- CREATE
- UPDATE
condition: "resource.tcpHealthCheck.port >= 1024 && resource.httpHealthCheck.port >= 1024 && resource.httpsHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 &&resource.http2HealthCheck.port >= 1024 && resource.grpcHealthCheck.port >= 1024"
actionType: ALLOW
displayName: Require port 1024 or greater for all health checks
description: All health check protocols must use a port of 1024 or higher, to avoid well-known ports.

禁止 GRPC 健康狀態檢查

name: organizations/ORGANIZATION_ID/customConstraints/custom.disallowGRPCHealthChecks
resourceTypes:
- compute.googleapis.com/HealthCheck
methodTypes:
- CREATE
- UPDATE
condition: "resource.type == 'GRPC'"
actionType: DENY
displayName: Disallow GRPC health checks
description: Health checks aren't allowed to use GRPC.

避免頻繁的健康狀態檢查探測要求

name: organizations/ORGANIZATION_ID/customConstraints/custom.minHealthCheckFrequency
resourceTypes:
- compute.googleapis.com/HealthCheck
methodTypes:
- CREATE
- UPDATE
condition: "resource.checkIntervalSec >= 30"
actionType: ALLOW
displayName: Disallow fast health check probes
description: Prevent health checks from having a probe frequency under 30 seconds.

目標 Proxy

用途	語法
禁止用戶端 HTTPS 保持運作逾時值超過 1000 秒	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.clientHTTPSKeepalive1000Sec resourceTypes: - compute.googleapis.com/TargetHttpsProxy methodTypes: - CREATE - UPDATE condition: "resource.httpKeepAliveTimeoutSec > 1000" actionType: DENY displayName: Disallow client HTTPS keepalive timeout greater than 1000 seconds description: Disallow client HTTPS keepalive timeout values greater than 1000 seconds.

用途

語法

禁止用戶端 HTTPS 保持運作逾時值超過 1000 秒

name: organizations/ORGANIZATION_ID/customConstraints/custom.clientHTTPSKeepalive1000Sec
resourceTypes:
- compute.googleapis.com/TargetHttpsProxy
methodTypes:
- CREATE
- UPDATE
condition: "resource.httpKeepAliveTimeoutSec > 1000"
actionType: DENY
displayName: Disallow client HTTPS keepalive timeout greater than 1000 seconds
description: Disallow client HTTPS keepalive timeout values greater than 1000 seconds.

網址對應

用途語法

用途	語法
要求網址對應必須針對 HTTP `500` 狀態碼提供自訂錯誤回應政策	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.urlMapCustomResponseHTTP500 resourceTypes: - compute.googleapis.com/UrlMaps methodTypes: - CREATE - UPDATE condition: "resource.defaultCustomErrorResponsePolicy.errorResponseRule.exists(value, value.matchResponseCode == 500)" actionType: ALLOW displayName: Require URL maps to have a custom error response policy for HTTP 500 errors description: URL maps must have a custom error response policy configured for HTTP 500 errors.

要求網址對應必須針對 HTTP 500 狀態碼提供自訂錯誤回應政策

name: organizations/ORGANIZATION_ID/customConstraints/custom.urlMapCustomResponseHTTP500
resourceTypes:
- compute.googleapis.com/UrlMaps
methodTypes:
- CREATE
- UPDATE
condition: "resource.defaultCustomErrorResponsePolicy.errorResponseRule.exists(value, value.matchResponseCode == 500)"
actionType: ALLOW
displayName: Require URL maps to have a custom error response policy for HTTP 500 errors
description: URL maps must have a custom error response policy configured for HTTP 500 errors.

目標執行個體

用途	語法
要求目標執行個體的名稱開頭必須是「targetInstance」字串	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.targetInstanceConstraint resourceTypes: - compute.googleapis.com/TargetInstance methodTypes: - CREATE - UPDATE condition: "resource.name.startsWith('targetInstance')" actionType: ALLOW displayName: Require target instances to have a name that starts with the string "targetInstance" description: Target instances must have resource names that start with the string "targetInstance"

用途

語法

要求目標執行個體的名稱開頭必須是「targetInstance」字串

name: organizations/ORGANIZATION_ID/customConstraints/custom.targetInstanceConstraint
resourceTypes:
- compute.googleapis.com/TargetInstance
methodTypes:
- CREATE
- UPDATE
condition: "resource.name.startsWith('targetInstance')"
actionType: ALLOW
displayName: Require target instances to have a name that starts with the string "targetInstance"
description: Target instances must have resource names that start with the string "targetInstance"

目標集區

用途	語法
要求目標集區必須具有 CLIENT_IP 工作階段相依性	name: organizations/`ORGANIZATION_ID`/customConstraints/custom.targetPoolConstraint resourceTypes: - compute.googleapis.com/TargetPool methodTypes: - CREATE - UPDATE condition: "resource.sessionAffinity == 'CLIENT_IP'" actionType: ALLOW displayName: Require target pools to use CLIENT_IP session affinity description: Target pools must use CLIENT_IP session affinity

用途

語法

要求目標集區必須具有 CLIENT_IP 工作階段相依性

name: organizations/ORGANIZATION_ID/customConstraints/custom.targetPoolConstraint
resourceTypes:
- compute.googleapis.com/TargetPool
methodTypes:
- CREATE
- UPDATE
condition: "resource.sessionAffinity == 'CLIENT_IP'"
actionType: ALLOW
displayName: Require target pools to use CLIENT_IP session affinity
description: Target pools must use CLIENT_IP session affinity

限制

不支援舊版健康狀態檢查 (舊版全域 (HTTP) 和舊版全域 (HTTPS))。
對於某些 Compute Engine 資源 (例如 Compute Engine SSL 政策資源)，系統也會在 UPDATE 方法上強制執行自訂限制。

後續步驟

進一步瞭解機構政策。
進一步瞭解如何建立及管理組織政策。
請參閱預先定義的機構政策限制完整清單。

使用自訂限制條件管理 Cloud Load Balancing 資源 透過集合功能整理內容 你可以依據偏好儲存及分類內容。

優點

Cloud Load Balancing 支援的資源

後端值區

後端服務

轉送規則

健康狀態檢查

網路端點群組

服務負載平衡政策

安全資料傳輸層 (SSL) 政策

目標執行個體

目標集區

目標 Proxy

網址對應

政策繼承

事前準備

Console

gcloud

必要的角色

所需權限

設定自訂限制

控制台

gcloud

強制執行自訂限制

控制台

gcloud

範例：使用自訂限制來限制 TLS 功能

範例：建立限制，將 TCP 健康狀態檢查通訊埠限制為至少 1024

gcloud

常見用途的更多範例

後端值區

後端服務

轉送規則

健康狀態檢查

目標 Proxy

網址對應

目標執行個體

目標集區

限制

後續步驟

使用自訂限制條件管理 Cloud Load Balancing 資源