本页面简要介绍了限制资源服务使用组织政策限制条件，这项政策可让企业管理员控制可以在其 Google Cloud资源层次结构中使用哪些Google Cloud 服务。此限制条件只能对资源是组织、文件夹或项目资源的直接后代的服务强制执行。例如，Compute Engine 和 Cloud Storage。
限制资源服务使用约束条件会排除某些对产品至关重要的依赖项服务，例如 Identity and Access Management (IAM)、Cloud Logging 和 Cloud Monitoring，并且不会对这些服务生效。 Google Cloud如需查看受此限制条件支持的云资源服务列表，请参阅限制资源使用支持的服务。
管理员可以使用此限制条件来定义对资源容器（例如组织、文件夹或项目）中允许的 Google Cloud 资源服务的分层限制。例如，允许项目 X 中的 storage.googleapis.com，或拒绝文件夹 Y 中的 compute.googleapis.com。此约束条件还决定了 Google Cloud 控制台的可用性。
如果您设置了一项组织政策来拒绝资源层次结构 B 中的服务 A，则当客户端尝试使用资源层次结构 B 中的服务 A 时，操作将失败。系统会返回错误消息，说明失败的原因，此外还会生成一个 AuditLog 条目以进一步监控、提醒或调试。
错误消息示例
Request is disallowed by organization's constraints/gcp.restrictServiceUsage
constraint for projects/PROJECT_ID attempting to use service
storage.googleapis.com.
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Restricting resource usage\n\nThis page provides an overview of the **Restrict Resource Service Usage**\n[organization policy constraint](/resource-manager/docs/organization-policy/overview#constraints),\nwhich allows enterprise administrators to control which\nGoogle Cloud services can be used within their Google Cloud\nresource hierarchy. This constraint can only be enforced on services with\nresources that are the direct descendants of an organization, folder, or project\nresource. For example, Compute Engine and Cloud Storage.\n\nThe **Restrict Resource Service Usage** constraint excludes and won't work with\ncertain services that are essential dependencies for Google Cloud\nproducts, such as Identity and Access Management (IAM), Cloud Logging, and\nCloud Monitoring. For the list of cloud resource services that are supported\nby this constraint,\nsee [Restricting resource usage supported services](/resource-manager/docs/organization-policy/restricting-resources-supported-services).\n\nAdministrators can use this constraint to define hierarchical restrictions on\nallowed Google Cloud resource services within a **resource container** ,\nsuch as an organization, a folder, or a project. For example, allow\n`storage.googleapis.com` within project X, or deny `compute.googleapis.com`\nwithin folder Y. This constraint also determines\n[Google Cloud console availability](#console).\n\nThe **Restrict Resource Service Usage** constraint can be used in two\nmutually exclusive ways:\n\n- Denylist - resources of any service that isn't denied are allowed.\n\n- Allowlist - resources of any service that isn't allowed are denied.\n\nThe **Restrict Resource Service Usage** constraint controls the runtime\naccess to all in-scope resources. When the organization policy containing this\nconstraint is updated, it immediately applies to all access to all resources\nwithin the scope of the policy, with eventual consistency.\n\nWe recommend administrators carefully manage updates to organization policies\ncontaining this constraint. You can more safely rollout this policy change by\nusing tags to conditionally enforce the constraint. For more information, see\n[Setting an organization policy with tags](/resource-manager/docs/organization-policy/tags-organization-policy).\n\nWhen a service is restricted by this policy, some Google Cloud services\nthat have a direct dependency on the restricted service will be restricted as\nwell. This only applies to services that manage the same customer resources.\nFor example, Google Kubernetes Engine (GKE) has a dependency on Compute Engine.\nWhen Compute Engine is restricted, GKE is also\nrestricted.\n| **Note:** Organization policy [audit logging](/resource-manager/docs/organization-policy/audit-logging) violations are logged in the [Policy Denied](/logging/docs/audit#policy_denied) category of Cloud Audit Logs. This is a billable category.\n\n### Google Cloud console availability\n\nRestricted services in the Google Cloud console behave in the following way:\n\n- You can't navigate to a product using the menu menu.\n- Restricted services don't appear in Google Cloud console search results.\n- When you navigate to a restricted service's Google Cloud console page---such as from a link or bookmark---an error message appears.\n\nUsing the Restrict Resource Service Usage constraint\n----------------------------------------------------\n\nOrganization policy constraints can be set at the organization, folder, and\nproject level. Each policy applies to all resources within its corresponding\nresource hierarchy, but can be overridden at lower levels in the resource\nhierarchy.\n\nFor more information about policy evaluation, see\n[Understanding Hierarchy Evaluation](/resource-manager/docs/organization-policy/understanding-hierarchy).\n\nSetting the organization policy\n-------------------------------\n\nTo set, change, or delete an organization policy, you must have the\n[Organization Policy Administrator](/resource-manager/docs/organization-policy/using-constraints#add-org-policy-admin) role. \n\n### Console\n\nTo set an organization policy that includes a\n**Restrict Resource Service Usage** constraint, do the following:\n\n1. In the Google Cloud console, go to the **Organization policies** page.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. From the project picker, select the resource on which you want to set the\n organization policy.\n\n3. In the table of organization policies, select\n **Restrict Resource Service Usage**.\n\n4. Click **Manage policy**.\n\n5. Under **Applies to** , select **Override parent's policy**.\n\n6. Under **Policy enforcement**, choose how to apply inheritance to this\n policy.\n\n 1. If you want to inherit the organization policy of the parent resource\n and merge it with this one, select **Merge with parent**.\n\n 2. If you want to override any existing organization policies, select\n **Replace**.\n\n7. Click **Add a rule**.\n\n8. Under **Policy values** , select **Custom**.\n\n9. Under **Policy type** , select **Deny** for denylist or **Allow** for\n allowlist.\n\n10. Under **Custom values**, add the service you want to block or allow to\n the list.\n\n 1. For example, to block Cloud Storage, you could enter\n `storage.googleapis.com`.\n\n 2. To add more services, click **Add value**.\n\n11. To enforce the policy, click **Set policy**.\n\n### gcloud\n\nOrganization policies can be set through the Google Cloud CLI. To enforce\nan organization policy that includes the **Restrict Resource Service Usage**\nconstraint, first create a YAML file with the policy to be updated: \n\n name: organizations/\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e/policies/gcp.restrictServiceUsage\n spec:\n rules:\n - values:\n deniedValues:\n - file.googleapis.com\n - bigquery.googleapis.com\n - storage.googleapis.com\n\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the ID of your organization resource.\nTo set this policy on that organization, run the following command: \n\n gcloud org-policies set-policy /tmp/policy.yaml\n\nTo learn about using constraints in organization policies, see\n[Using Constraints](/resource-manager/docs/organization-policy/using-constraints#list-constraint).\n\nRestricting untagged resources\n------------------------------\n\nYou can use tags and conditional organization policies to restrict any resources\nthat are not using a particular tag. If you set an organization policy on\na resource that restricts services and make it conditional on the presence of a\ntag, no child resources descended from that resource can be used unless they\nhave been tagged. In this way, resources must be set up in accordance with your\ngovernance plan before they can be used.\n\nTo restrict untagged organization, folder, or project resources, you can use the\n`!` logical operator in a conditional query when creating your organization\npolicy.\n\nFor example, to allow the usage of `sqladmin.googleapis.com` only in projects\nthat have the tag `sqladmin=enabled`, you can create an organization policy that\ndenies `sqladmin.googleapis.com` on projects that do not have the tag\n`sqladmin=enabled`.\n\n1. [Create a tag](/resource-manager/docs/tags/tags-creating-and-managing#creating_tag)\n that identifies whether the resources have had proper governance\n applied. For example, you could create a tag with the key `sqlAdmin` and the\n value `enabled`, to designate that this resource should allow the usage of\n the Cloud SQL Admin API. For example:\n\n2. Click on the name of the newly created tag. You need the namespaced name\n of the tag key, listed under **Tag key path**, in the next steps to create a\n condition.\n\n3. Create a **Restrict Resource Service Usage** organization policy at the level\n of your organization resource to deny access to the Cloud SQL Admin API. For example:\n\n4. Add a condition to the above organization policy, specifying that the policy\n is enforced if the governance tag is not present. The logical NOT operator\n is not supported by the condition builder, so this condition must be built\n in the condition editor. For example:\n\n `!resource.matchTag(\"012345678901/sqlAdmin\", \"enabled\")`\n\nNow, the `sqlAdmin=enabled` tag must be attached to or inherited by a project,\nbefore your developers can use the Cloud SQL Admin API with that project.\n\nFor more information about creating conditional organization policies, see\n[Setting an organization policy with tags](/resource-manager/docs/organization-policy/tags-organization-policy).\n\nCreate an organization policy in dry-run mode\n---------------------------------------------\n\nAn organization policy in dry-run mode is a type of organization policy where\nviolations of the policy are audit logged, but the violating actions aren't\ndenied. You can create an organization policy in dry-run mode using the\n**Restrict Resource Service Usage** constraint to monitor how it would affect\nyour organization before you enforce the live policy. For more information, see\n[Create an organization policy in dry-run mode](/resource-manager/docs/organization-policy/dry-run-policy#create_dry_run_list_policy).\n\nError message\n-------------\n\nIf you set an organization policy to deny service A within resource\nhierarchy B, when a client tries to use service A within resource hierarchy B,\nthe operation fails. An error is returned that describes the reason\nfor this failure. Also, an AuditLog entry is generated for further monitoring,\nalerting, or debugging.\n\n### Example error message\n\n```\nRequest is disallowed by organization's constraints/gcp.restrictServiceUsage\nconstraint for projects/PROJECT_ID attempting to use service\nstorage.googleapis.com.\n```\n\n### Example Cloud Audit Logs"]]
