[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Organization policy constraints\n===============================\n\nThis page provides information about the [organization\npolicy](/resource-manager/docs/organization-policy/overview) constraints\nthat you can configure for Cloud NAT.\n\nNetwork administrators can create Cloud NAT configurations and\nspecify which subnetworks (subnets) can use the gateway. By default, there\nare no limits to what subnets the administrator creates or which of them\ncan use a Cloud NAT configuration.\n\nAn Organization Policy Administrator (`roles/orgpolicy.policyAdmin`) can use the `constraints/compute.restrictCloudNATUsage` constraint to limit which\nsubnets can use Cloud NAT.\n\nYou create and enforce organizational constraints in an organization policy.\n\nPrerequisites\n-------------\n\n### IAM permissions\n\n- The person creating the constraints must have the [roles/orgpolicy.policyAdmin](/iam/docs/understanding-roles#organization-policy-roles) role.\n- If using Shared VPC, the user role must be in the host project.\n\n### Organization policy background\n\nIf you have not worked with organization policy constraints before, first review\nthe following documentation:\n\n- [Understanding constraints](/resource-manager/docs/organization-policy/understanding-constraints)\n- [Understanding hierarchy evaluation](/resource-manager/docs/organization-policy/understanding-hierarchy)\n\nPlanning your constraints\n-------------------------\n\nYou can create `allow` or `deny` constraints at the following levels\nof the resource hierarchy:\n\n- Organization\n- Folder\n- Project\n- Subnetwork\n\nBy default, a constraint created at a node is inherited by all child nodes.\nHowever, an Organization Policy Administrator for a given folder can decide if a\ngiven folder inherits from its parents, so inheritance is not\nautomatic. For more information, see\n[Inheritance](/resource-manager/docs/organization-policy/understanding-hierarchy#inheritance)\nin *Understanding hierarchy evaluation*.\n\nConstraints are not applied retroactively. Existing configurations continue to\nwork even if they violate the constraints.\n\nConstraints consist of `allow` and `deny` settings.\n\n### Interaction between allowed and denied values\n\n- If a `restrictCloudNatUsage` constraint is configured but neither `allowedValues` nor `deniedValues` is specified, everything is allowed.\n- If `allowedValues` is configured and `deniedValues` is not configured, everything not specified in `allowedValues` is denied.\n- If `deniedValues` is configured and `allowedValues` is not configured, everything not specified in `deniedValues` is allowed.\n- If both `allowedValues` and `deniedValues` are configured, everything not specified in `allowedValues` is denied.\n- If two values conflict, `deniedValues` takes precedence.\n\n### Interaction between subnets and gateways\n\nConstraints do not prevent subnets from using a NAT gateway. Instead,\nconstraints prevent a configuration that would violate the constraint\nby preventing the creation of either a gateway or a subnet.\n\n#### Example 1: Trying to create a subnet that violates a `deny` rule\n\n1. A gateway exists in a region.\n2. The gateway is configured to allow all subnets in a region to use it.\n3. A single subnet (`subnet-1`) exists in the region.\n4. A constraint is created so that only `subnet-1` can use the gateway.\n5. Administrators are not able to create more subnets in that network in that region. The constraint prevents the creation of subnets that *would* be able to use the gateway. If the new subnets should exist, then the Organization Policy Administrator can add these subnets to the list of permitted subnets.\n\n#### Example 2: Trying to create a gateway that violates a `deny` rule\n\n1. Two subnets (`subnet-1` and `subnet-2`) exist in a region.\n2. A constraint exists that only allows `subnet-1` to use a gateway.\n3. Administrators are not able to create a gateway that is open to all subnets in the region. Instead, either they have to create a gateway that only serves `subnet-1`, or the Organization Policy Administrator has to add `subnet-2` to the list of permitted subnets.\n\nCreating your constraints\n-------------------------\n\nTo create an organization policy with a particular constraint, see\n[Using constraints](/resource-manager/docs/organization-policy/using-constraints).\n\nWhat's next\n-----------\n\n- Learn about how to use [custom organization policies](/nat/docs/custom-constraints).\n- Set up a [Public NAT gateway](/nat/docs/set-up-network-address-translation).\n- Set up a [Private NAT gateway](/nat/docs/set-up-private-nat)."]]
