Resource Manager release notes

You can use custom constraints with Organization Policy to provide more granular control over specific fields for some Secure Source Manager resources. For more information, see Manage resources with custom constraints.

The Organization Policy recommender generates insights and organization policy recommendations to restrict the creation and upload of service account keys. This feature is available in Preview.

You can use the iam.managed.allowedPolicyMembers managed organization policy constraint to implement domain restricted sharing. For more information, see Domain restricted sharing.

You can use Organization Policy Service custom constraints to manage specific operations on Bigtable resources. For more information, see Use custom organization policies. This feature is generally available (GA).

Cloud Load Balancing resources now let you use custom constraints to define your own restrictions on Google Cloud services. To learn about which load balancing resources support custom constraints, and some sample use cases, see Manage Cloud Load Balancing resources using custom constraints.

This feature is available in General Availability.

You can use the iam.managed.preventPrivilegedBasicRolesForDefaultServiceAccounts managed organization policy constraint to prevent default service accounts from being granted the Editor (roles/editor) or Owner (roles/owner) roles. For more information, see Prevent the Owner and Editor role from being granted to default service accounts.

You can now manage Firestore resources using Organization Policy Service custom constraints.

Organization Policy managed constraints are a set of constraints built on the custom organization policy platform. You can use managed constraints in place of certain predefined constraints to perform dry-run tests and simulate changes to your policies using Policy Intelligence tools. This feature is now in General Availability.

Cloud Data Fusion supports annotating resources with tags in Preview. For more information, see the Services that support tags.

You can add tags at the time of creating folders and projects. These tags can be added as key-value pairs. For more information, see Add tags during folder creation and Add tags during project creation. This feature is currently in preview.

Policy Analyzer for Organization Policy is now in General Availability.

You can use the Google Cloud console with Policy Simulator for Organization Policy to test organization policies. This feature is available in Preview.

With the secure-by-default organization policy enforcements, insecure posture is addressed with a bundle of organization policies that are enforced at the time of creation of an organization resource. Enforcement of these policies will apply to organizations created early in 2024, as the feature is gradually rolled out.

The dry-run feature for Organization Policy is now in General Availability.

Organization Policy custom constraints allow you to configure customizable organization policies to prevent the misconfiguration of resources and help you meet your security and compliance goals. This feature is now in General Availability.

You can use the Google Cloud console to analyze organization policies. This feature is available in Preview.

Tag key and value short names can now have a maximum length of 256 characters. For more information, see Tags overview.

New Organization Policy constraints have launched into general availability to define service attachment controls for Private Service Connect consumers. For more information, see Manage security for Private Service Connect consumers.

Policy Simulator for Organization Policy allows you to test organization policies before they are enforced. This feature is available in Preview.

New Organization Policy constraints have launched into general availability to define access and creation controls for Vertex AI Workbench notebooks and instances. For more information, see Organization policy constraints.

Two automatically configured Organization Policy constraints have launched into general availability to provide advanced regulatory control for Assured Workloads. For more information, see Organization policy constraints.

You can now monitor how custom constraints would impact your organization's workflows by setting custom constraints in dry-run mode.

You can now create dry-run organization policies using the Google Cloud console.

You can now create tags that are children of projects as well as organization resources. For more information, see Creating and managing tags.

You can now create dry-run organization policies to monitor how policy changes would impact your workflows before they are enforced.

The organization restrictions feature has entered General Availability. The organization restrictions feature helps security administrators to prevent data exfiltration due to phishing or insider attacks. The organization restrictions feature restricts access only to resources in authorized Google Cloud organizations. For more information, see Introduction to organization restrictions.

Policy Analyzer now offers organization policy analysis. Policy Analyzer helps you get more information about the resources affected by an organization policy constraint. This feature is available in Preview.

The feature for listing all tags that are attached to or inherited by your resources has entered general availability. For more information, see Creating and managing tags.

You can now use the Cloud Console UI to create and manage tags. For more information, see Creating and managing tags.

The organization restrictions feature has launched into public preview. The organization restrictions feature enables you to prevent data exfiltration through phishing or insider attacks. For managed devices in an organization, the organization restrictions feature restricts access only to resources in authorized Google Cloud organizations. For more information, see Introduction to organization restrictions.

Organization Policy custom constraints has launched into public preview. Custom constraints can allow or restrict access to API calls in the same way that predefined constraints do, but allow administrators to configure conditions based on request parameters and other metadata. For more information, see Creating and managing custom constraints.

Two Organization Policy constraints have launched into general availability to help ensure CMEK usage across an organization. For more information, see CMEK organization policies.

A feature for protecting tag values from being deleted has launched into general availability. If a tag value has a tag hold, it cannot be deleted by users unless the tag hold is first deleted. For more information about tag holds, see Protecting tag values with tag holds.

The following organization policy constraints to restrict resource creation of global security configuration have launched into general availability:

• Disable Creation of Cloud Armor Security Policies
• Disable Creation of global self-managed SSL Certificates
• Disable Global Load Balancing
• Disable Enabling Identity-Aware Proxy (IAP) on global resources
• Disable Enabling Identity-Aware Proxy (IAP) on regional resources

The feature for listing the effectively evaluated tags on a resource has launched into public preview. For more information, see Listing effective tags on a resource.

The resource usage restriction Organization Policy constraint has launched into general availability.

The Organization Policy Service v2 API reference documentation is now available. For more information, see the API reference documentation.

You can now use the Cloud Console UI to manage your organization policies with tags. For more information, see Setting an organization policy with tags.

The Organization Policy constraints Allowed ingress settings and Allowed VPC egress settings for Cloud Run have launched into general availability.

The Resource Settings API has entered general availability. You can use Resource Settings to centrally configure settings for your Google Cloud projects, folders, and organization. For more information, see Resource Settings overview.

The process for migrating a project from one organization to another has released into general availability. To make it easier to see the impact a project migration will have on your organization, you can use the Cloud Asset Inventory Analyze Move API to get a detailed report before performing a move. For more information, see Migrating projects and Analyze project move.

The Resource Manager v3 API has been released into general availability. For more information, see the API reference documentation.

The Resource Manager v3 API has been released into public preview. For more information, see the API reference documentation.

The Organization Policy Service v2 API has launched into general availability.

• You can now apply conditions for the enforcement of organization policies. For more information, see Setting an organization policy with tags.
• For more details about the new version of the API, see the v2 tabs on the Using constraints page.

Tags have been launched into general availability. For more information, see the Tags overview.

Project migration between organizations is now a self-serve process in public preview. For more information, see Migrating projects.

Tags have released into public preview. Tags provide a way to conditionally allow or deny policies based on whether a resource has a specific tag. You can use tags and conditional enforcement of policies for fine-grained control across your resource hierarchy. For more information, see the Tags overview.

You can now customize who receives notifications from Google Cloud with Essential Contacts. This feature is available in preview. For more information, see Managing contacts for notifications.

The Organization policy constraints for Direct Path disablement have launched into beta.

The Organization policy constraint for Cloud NAT has launched into beta.

The Organization Policies for restricting Cloud Interconnect usage have launched into beta.

The Organization Policy for restricting protocol forwarding creation has launched into general availability.

The Organization policy for restricting Cloud Load Balancing creation has launched into general availability.

The Organization Policy for extending the maximum lifetime for OAuth 2.0 access tokens that you create for a service account has been launched into general availability.

The Organization Policy for enabling detailed Cloud Audit Logs has launched into general availability.

The Organization Policy for restricting protocol forwarding creation has launched into public beta.

The Organization Policy for restricting automatic IAM permission grants to new service accounts has launched into general availability.

The Organization Policy for restricting peer IP addresses through a Cloud VPN tunnel has been launched into general availability.

The Organization Policy Service resource locations constraint has launched for general availability. This constraint allows you to define the location where your resources are created, providing important data location compliance tools. For more information, see the Restricting Resource Locations.

VPC Service Controls (VPC SC) helps you to set up a secure perimeter to guard against data exfiltration. The VPC SC Organization Policies have been launched into public beta.

The IAM Domain Restriction Organization Policies have been launched into general availability.

The Organization Policies for service account management have been launched into general availability.

Resource location restriction constraint beta release

The Organization Policy Service resource locations constraint allows you to define the location where your resources are created. For more information, see the quickstart or the how-to guide.

Organization policy administrative UI beta release

The Organization Policy Service administrative UI allows you to create and manage organization policies in the Google Cloud Platform Console.

Organization setup wizard beta release

The organization setup wizard UI makes it easier for you to delegate setup and management of Organization resources to other users, assign fundamental IAM roles to users, and import existing projects and billing accounts to your organization.

Service account restriction organization policy constraint beta release

The service account restriction constraint can be used to limit the usage of Identity and Access Management service accounts.

Domain restriction organization policy constraint beta release

The domain restriction constraint can be used to restrict the set of identities that can be used in Identity and Access Management policies.

Audit Logging for ContactInfo Beta Release

Audit Logging support has been expanded to support the European Union General Data Protection Regulation (GDPR). The UpdateContactInfo and GetContactInfo operations have been added to the list of audited operations.

Organization Policy General Availability

The Organization Policy service gives you central, programmatic control over your Organization's Cloud resources. It provides a simple mechanism for you to restrict allowed configurations across your entire Cloud Resource hierarchy.

Folders General Availability

Cloud folders are nodes in the Cloud Platform Resource Hierarchy. A folder can contain projects, other folders, or a combination of both. You can use folders to group projects under an organization in a hierarchy. For example, you organization might contain multiple departments, each with its own set of Cloud Platform resources. Folders allows you to group these resources on a per-department basis. Folders are used to group resources that share common IAM policies.

Organization Resource Automatic Provisioning

With this launch we made the Organization resource automatically available to all Google Workspace and Cloud Identity customers. Google Workspace customers just need to create a project using their domain email account and the Organization resource will be automatically provisioned for them.