Manage consumer policies

Hierarchical service activation lets you manage service enablement that is inherited through the Google Cloud resource hierarchy. For more information, see the overview.

The ConsumerPolicy is a Service Usage API resource found at each level of the Google Cloud resource hierarchy. This resource, always named default, contains the enableRules that define which services are enabled. Instead of enabling or disabling a specific service, you can modify the ConsumerPolicy resource. When a service name is in its list, the service is enabled at that hierarchy level.

This document shows you how to use the Google Cloud CLI to manage consumer policies for projects, folders, and organizations.

Before you begin

1. Complete the "Before you begin" steps detailed in the Manage service enablement guide.

2. If you don't indicate the Google Cloud resource that you want to manage, the commands in this document default to the current project. For example, gcloud beta services policies get --policy-name=default returns the consumer policy for the current project.

   You can retrieve the current project ID:

   gcloud config list --format='text(core.project)'
   

Get a consumer policy

You can retrieve the ConsumerPolicy for a project, folder, or organization by using the gcloud beta services policies get command.

This command returns the enableRules set at that exact resource level, and not inherited rules. For a more complete view that includes inherited rules, you can retrieve the effective policy. Only the default policy name is supported.

gcloud beta services policies get --policy-name=default \
    --project=PROJECT_ID \
    --output-file=OUTPUT_FILE

gcloud beta services policies get --policy-name=default \
    --folder=FOLDER_ID \
    --output-file=OUTPUT_FILE

gcloud beta services policies get --policy-name=default \
    --organization=ORGANIZATION_ID \
    --output-file=OUTPUT_FILE

Update a consumer policy

You can update a ConsumerPolicy by using the gcloud beta services policies update command. This lets you replace the current policy and use a YAML file to update many enabled services at once.

This command doesn't automatically enable service dependencies. You must list all service dependencies explicitly in the input file. You can use the --validate-only flag to preview changes before applying them.

gcloud beta services policies update --consumer-policy-file=PATH_TO_CONSUMER_POLICY

Replace PATH_TO_CONSUMER_POLICY with the path to the YAML file that contains the consumer policy—for example:

gcloud beta services policies update --consumer-policy-file=/path/to/the/file.yaml

Supported flags:

• --bypass-api-usage-check to bypass usage checks. Otherwise, the system returns an error if any service you want to disable was used in the last 30 days or enabled in the last 3 days.

• --bypass-dependency-check to bypass the check for dependencies. When adding a service, all service dependencies must be present in the policy. When removing a service, no other services in the policy can depend on it. Otherwise, the update doesn't succeed and an error is returned.

• --validate-only to validate the update without actually performing the operation.

Note the following:

• To get a YAML template for the policy file, first retrieve the consumer policy and use the --output-file flag to save the policy to a file. Then, modify this file and use it as input for the update command. Sample template:

  name: projects/PROJECT_ID/consumerPolicies/default
  enableRules:
    services:
      - services/SERVICE
      - ...
      - ...
  

  Replace the following:

  • PROJECT_ID: your Google Cloud project ID. Other supported resource names follow a similar format—for example: folders/FOLDER_ID/consumerPolicies/default.

  • SERVICE: the name of the service—for example: bigquery.googleapis.com.

Get an effective policy

You can retrieve the effective policy for a resource by using the gcloud beta services policies get-effective command.

The effective policy combines the resource's ConsumerPolicy with the policies of all its ancestors. This gives you a complete view of all enabled services, including all services enabled directly on the resource, and those inherited from its ancestors.

gcloud beta services policies get-effective --project=PROJECT_ID \
    --view=VIEW

gcloud beta services policies get-effective --folder=FOLDER_ID \
    --view=VIEW

gcloud beta services policies get-effective --organization=ORGANIZATION_ID \
    --view=VIEW

Check if a service is enabled

You can check if a service is enabled on a resource by using the gcloud beta services policies test-enabled command.

When checking the status of a service, this command considers the effective policy and the full Google Cloud resource hierarchy.

gcloud beta services policies test-enabled SERVICE \
    --project=PROJECT_ID

gcloud beta services policies test-enabled SERVICE \
    --folder=FOLDER_ID

gcloud beta services policies test-enabled SERVICE \
    --organization=ORGANIZATION_ID

Examples

What's next

• To enable and disable services, see Manage service enablement.
• To inspect service dependencies, see List service dependencies.