gcp-custom-constraints-directory

Regularly-updated directory of all custom constraint resource types and fields available in Google Cloud Platform (GCP) Organisation Policy, sourced from GCP documentation.

Summary

Access Context Manager

• accesscontextmanager.googleapis.com/AccessLevel (17 fields)
• accesscontextmanager.googleapis.com/AccessPolicy (3 fields)
• accesscontextmanager.googleapis.com/AuthorizedOrgsDesc (4 fields)
• accesscontextmanager.googleapis.com/ServicePerimeter (46 fields)

Agent Identity API

• agentidentity.googleapis.com/AuthProvider (12 fields)

AI Platform Training

• aiplatform.googleapis.com/CustomJob (47 fields)
• aiplatform.googleapis.com/HyperparameterTuningJob (89 fields)
• aiplatform.googleapis.com/NasJob (102 fields)

AlloyDB for PostgreSQL

• alloydb.googleapis.com/Backup
• alloydb.googleapis.com/Cluster
• alloydb.googleapis.com/Instance

API keys

• apikeys.googleapis.com/Key (9 fields)

Application Integration

• integrations.googleapis.com/AuthConfig (7 fields)
• integrations.googleapis.com/IntegrationVersion (95 fields)
• integrations.googleapis.com/SfdcChannel (3 fields)
• integrations.googleapis.com/SfdcInstance (3 fields)

Artifact Analysis

• containeranalysis.googleapis.com/Note (24 fields)
• containeranalysis.googleapis.com/Occurrence (27 fields)

Artifact Registry

• artifactregistry.googleapis.com/Repository (1 field)

Backup and DR Service

• backupdr.googleapis.com/Backup (9 fields)
• backupdr.googleapis.com/BackupPlan (15 fields)
• backupdr.googleapis.com/BackupPlanAssociation (3 fields)
• backupdr.googleapis.com/BackupVault (4 fields)

Backup for GKE

• gkebackup.googleapis.com/Backup (3 fields)
• gkebackup.googleapis.com/BackupPlan (20 fields)
• gkebackup.googleapis.com/Restore (13 fields)
• gkebackup.googleapis.com/RestorePlan (35 fields)

BigQuery

• bigquery.googleapis.com/Dataset (17 fields)
• bigquery.googleapis.com/Routine (3 fields)
• bigquery.googleapis.com/RowAccessPolicy (4 fields)
• bigquery.googleapis.com/Table (3 fields)

BigQuery Data Policy

• bigquerydatapolicy.googleapis.com/DataPolicy (2 fields)

BigQuery Data Transfer Service

• bigquerydatatransfer.googleapis.com/TransferConfig (18 fields)

BigQuery Migration Service

• bigquerymigration.googleapis.com/MigrationWorkflow (39 fields)

BigQuery Reservation API

• bigqueryreservation.googleapis.com/BiReservation (5 fields)
• bigqueryreservation.googleapis.com/CapacityCommitment (4 fields)
• bigqueryreservation.googleapis.com/Reservation (12 fields)
• bigqueryreservation.googleapis.com/ReservationAssignment (4 fields)

BigQuery sharing

• analyticshub.googleapis.com/DataExchange (7 fields)
• analyticshub.googleapis.com/Listing (25 fields)

Binary Authorization

• binaryauthorization.googleapis.com/Attestor (8 fields)
• binaryauthorization.googleapis.com/Policy (18 fields)

Certificate Authority Service

• privateca.googleapis.com/CaPool (51 fields)
• privateca.googleapis.com/CertificateAuthority (63 fields)
• privateca.googleapis.com/CertificateTemplate (40 fields)

Certificate Manager

• certificatemanager.googleapis.com/Certificate (7 fields)
• certificatemanager.googleapis.com/CertificateIssuanceConfig (6 fields)
• certificatemanager.googleapis.com/CertificateMap (2 fields)
• certificatemanager.googleapis.com/CertificateMapEntry (5 fields)
• certificatemanager.googleapis.com/DnsAuthorization (4 fields)
• certificatemanager.googleapis.com/TrustConfig (5 fields)

Cloud Bigtable Admin API

• bigtableadmin.googleapis.com/AppProfile (7 fields)
• bigtableadmin.googleapis.com/Backup (5 fields)
• bigtableadmin.googleapis.com/Cluster (10 fields)
• bigtableadmin.googleapis.com/Instance (2 fields)
• bigtableadmin.googleapis.com/LogicalView (2 fields)
• bigtableadmin.googleapis.com/MaterializedView (2 fields)
• bigtableadmin.googleapis.com/SchemaBundle (2 fields)
• bigtableadmin.googleapis.com/Table (6 fields)

Cloud Build

• cloudbuild.googleapis.com/BitbucketServerConfig (10 fields)
• cloudbuild.googleapis.com/Build (95 fields)
• cloudbuild.googleapis.com/BuildTrigger (159 fields)
• cloudbuild.googleapis.com/Connection (33 fields)
• cloudbuild.googleapis.com/GithubEnterpriseConfig (11 fields)
• cloudbuild.googleapis.com/Repository (3 fields)
• cloudbuild.googleapis.com/WorkerPool (10 fields)

Cloud Data Fusion

• datafusion.googleapis.com/DnsPeering (5 fields)
• datafusion.googleapis.com/Instance (27 fields)

Cloud Deploy

• clouddeploy.googleapis.com/Automation (25 fields)
• clouddeploy.googleapis.com/CustomTargetType (14 fields)
• clouddeploy.googleapis.com/DeliveryPipeline (37 fields)
• clouddeploy.googleapis.com/DeployPolicy (16 fields)
• clouddeploy.googleapis.com/Release (9 fields)
• clouddeploy.googleapis.com/Rollout (4 fields)
• clouddeploy.googleapis.com/Target (29 fields)

Cloud DNS

• dns.googleapis.com/ManagedZone (17 fields)
• dns.googleapis.com/Policy (9 fields)
• dns.googleapis.com/ResourceRecordSet (46 fields)
• dns.googleapis.com/ResponsePolicy (4 fields)
• dns.googleapis.com/ResponsePolicyRule (49 fields)

Cloud Domains

• domains.googleapis.com/Registration (2 fields)

Cloud Healthcare API

• healthcare.googleapis.com/ConsentStore (3 fields)
• healthcare.googleapis.com/Dataset (3 fields)
• healthcare.googleapis.com/DicomStore (7 fields)
• healthcare.googleapis.com/FhirStore (55 fields)
• healthcare.googleapis.com/Hl7V2Store (14 fields)

Cloud Interconnect

• compute.googleapis.com/Interconnect (15 fields)
• compute.googleapis.com/InterconnectAttachment (14 fields)

Cloud Key Management Service

• cloudkms.googleapis.com/AutokeyConfig (3 fields)
• cloudkms.googleapis.com/CryptoKey (9 fields)
• cloudkms.googleapis.com/CryptoKeyVersion (3 fields)
• cloudkms.googleapis.com/EkmConfig (1 field)
• cloudkms.googleapis.com/EkmConnection (6 fields)
• cloudkms.googleapis.com/ImportJob (3 fields)
• cloudkms.googleapis.com/KeyHandle (2 fields)

Cloud Load Balancing

• compute.googleapis.com/BackendBucket (20 fields)
• compute.googleapis.com/BackendService (96 fields)
• compute.googleapis.com/ForwardingRule (22 fields)
• compute.googleapis.com/HealthCheck (40 fields)
• compute.googleapis.com/InstanceGroup (4 fields)
• compute.googleapis.com/NetworkEndpointGroup (17 fields)
• compute.googleapis.com/SslPolicy
• compute.googleapis.com/TargetGrpcProxy (3 fields)
• compute.googleapis.com/TargetHttpProxy (4 fields)
• compute.googleapis.com/TargetHttpsProxy (6 fields)
• compute.googleapis.com/TargetInstance (3 fields)
• compute.googleapis.com/TargetPool (4 fields)
• compute.googleapis.com/TargetSslProxy (3 fields)
• compute.googleapis.com/TargetTcpProxy (4 fields)
• compute.googleapis.com/UrlMap (230 fields)
• networkservices.googleapis.com/ServiceLbPolicy (5 fields)

Cloud Logging

• logging.googleapis.com/Link (1 field)
• logging.googleapis.com/LogBucket (6 fields)
• logging.googleapis.com/LogMetric (19 fields)
• logging.googleapis.com/LogSink (10 fields)
• logging.googleapis.com/LogView (2 fields)
• logging.googleapis.com/SavedQuery (5 fields)

Cloud Monitoring

• monitoring.googleapis.com/AlertPolicy (60 fields)
• monitoring.googleapis.com/NotificationChannel (4 fields)
• monitoring.googleapis.com/Snooze (4 fields)

Cloud Next Generation Firewall

• compute.googleapis.com/Firewall (17 fields)
• compute.googleapis.com/FirewallPolicy (28 fields)

Cloud Quotas

• cloudquotas.googleapis.com/QuotaPreference (5 fields)

Cloud Router, Cloud NAT

• compute.googleapis.com/Router (55 fields)

Cloud Run

• run.googleapis.com/Job
• run.googleapis.com/Service

Cloud Run functions

• cloudfunctions.googleapis.com/Function

Cloud Service Mesh

• networksecurity.googleapis.com/AuthorizationPolicy (10 fields)
• networksecurity.googleapis.com/ClientTlsPolicy (7 fields)
• networksecurity.googleapis.com/ServerTlsPolicy (10 fields)
• networkservices.googleapis.com/EndpointPolicy (10 fields)
• networkservices.googleapis.com/Gateway (16 fields)
• networkservices.googleapis.com/GrpcRoute (23 fields)
• networkservices.googleapis.com/HttpRoute (73 fields)
• networkservices.googleapis.com/Mesh (4 fields)
• networkservices.googleapis.com/ServiceBinding (2 fields)
• networkservices.googleapis.com/TcpRoute (10 fields)
• networkservices.googleapis.com/TlsRoute (10 fields)

Cloud SQL

• sqladmin.googleapis.com/BackupRun (2 fields)
• sqladmin.googleapis.com/Instance (79 fields)

Cloud Storage

• storage.googleapis.com/Bucket (42 fields)

Cloud VPN

• compute.googleapis.com/ExternalVpnGateway (5 fields)
• compute.googleapis.com/TargetVpnGateway (3 fields)
• compute.googleapis.com/VpnGateway (6 fields)
• compute.googleapis.com/VpnTunnel (13 fields)

Cloud Workstations

• workstations.googleapis.com/Workstation (5 fields)
• workstations.googleapis.com/WorkstationCluster (9 fields)
• workstations.googleapis.com/WorkstationConfig (55 fields)

Colab Enterprise

• aiplatform.googleapis.com/NotebookExecutionJob (26 fields)
• aiplatform.googleapis.com/NotebookRuntime (3 fields)
• aiplatform.googleapis.com/NotebookRuntimeTemplate (26 fields)

Compute Engine

• compute.googleapis.com/Disk (6 fields)
• compute.googleapis.com/Image (1 field)
• compute.googleapis.com/Instance (34 fields)
• compute.googleapis.com/PreviewFeature

Data Lineage API

• datalineage.googleapis.com/Process (5 fields)

Database Migration Service

• datamigration.googleapis.com/ConnectionProfile (89 fields)
• datamigration.googleapis.com/ConversionWorkspace (9 fields)
• datamigration.googleapis.com/MigrationJob (50 fields)
• datamigration.googleapis.com/PrivateConnection (5 fields)

Dataflow

• dataflow.googleapis.com/Job

Dataform

• dataform.googleapis.com/CompilationResult (14 fields)
• dataform.googleapis.com/Folder (2 fields)
• dataform.googleapis.com/ReleaseConfig (17 fields)
• dataform.googleapis.com/Repository (15 fields)
• dataform.googleapis.com/TeamFolder (1 field)
• dataform.googleapis.com/WorkflowConfig (14 fields)
• dataform.googleapis.com/WorkflowInvocation (11 fields)
• dataform.googleapis.com/Workspace (1 field)

Dataproc Metastore

• metastore.googleapis.com/Backup (2 fields)
• metastore.googleapis.com/MetadataImport (5 fields)
• metastore.googleapis.com/Service (30 fields)

Datastream

• datastream.googleapis.com/ConnectionProfile (38 fields)
• datastream.googleapis.com/PrivateConnection (4 fields)
• datastream.googleapis.com/Stream (179 fields)

Developer Connect

• developerconnect.googleapis.com/AccountConnector
• developerconnect.googleapis.com/Connection
• developerconnect.googleapis.com/GitRepositoryLink

Document AI

• documentai.googleapis.com/Processor (3 fields)
• documentai.googleapis.com/ProcessorVersion (1 field)

Essential Contacts

• essentialcontacts.googleapis.com/Contact (3 fields)

Eventarc

• eventarc.googleapis.com/Channel (3 fields)
• eventarc.googleapis.com/ChannelConnection (3 fields)
• eventarc.googleapis.com/Enrollment (6 fields)
• eventarc.googleapis.com/GoogleApiSource (6 fields)
• eventarc.googleapis.com/GoogleChannelConfig (2 fields)
• eventarc.googleapis.com/MessageBus (5 fields)
• eventarc.googleapis.com/Pipeline (23 fields)
• eventarc.googleapis.com/Trigger (20 fields)

Filestore

• file.googleapis.com/Backup (4 fields)
• file.googleapis.com/Instance (29 fields)
• file.googleapis.com/Snapshot (1 field)

Firestore

• firestore.googleapis.com/Database (8 fields)

Gemini Enterprise Agent Platform

• aiplatform.googleapis.com/ReasoningEngine (42 fields)

GKE

• container.googleapis.com/Cluster (298 fields)
• container.googleapis.com/NodePool (112 fields)

GKE attached clusters

• gkemulticloud.googleapis.com/AttachedCluster

GKE Fleet

• gkehub.googleapis.com/Feature
• gkehub.googleapis.com/Fleet
• gkehub.googleapis.com/Membership
• gkehub.googleapis.com/MembershipBinding
• gkehub.googleapis.com/Namespace
• gkehub.googleapis.com/RBACRoleBinding
• gkehub.googleapis.com/Scope

GKE on AWS

• gkemulticloud.googleapis.com/AwsCluster
• gkemulticloud.googleapis.com/AwsNodePool

GKE on Azure

• gkemulticloud.googleapis.com/AzureClient
• gkemulticloud.googleapis.com/AzureCluster
• gkemulticloud.googleapis.com/AzureNodePool

GKE On-Prem API

• gkeonprem.googleapis.com/BareMetalAdminCluster (33 fields)
• gkeonprem.googleapis.com/BareMetalCluster (68 fields)
• gkeonprem.googleapis.com/BareMetalNodePool (13 fields)
• gkeonprem.googleapis.com/VmwareAdminCluster (50 fields)
• gkeonprem.googleapis.com/VmwareCluster (60 fields)
• gkeonprem.googleapis.com/VmwareNodePool (20 fields)

Google Cloud Armor

• compute.googleapis.com/NetworkEdgeSecurityService
• compute.googleapis.com/SecurityPolicy

Google Cloud Contact Center as a Service

• contactcenteraiplatform.googleapis.com/ContactCenter (2 fields)

Google Cloud Managed Service for Apache Kafka

• managedkafka.googleapis.com/Cluster (12 fields)

Google Cloud NetApp Volumes

• netapp.googleapis.com/ActiveDirectory (13 fields)
• netapp.googleapis.com/Backup (7 fields)
• netapp.googleapis.com/BackupPolicy (6 fields)
• netapp.googleapis.com/BackupVault (11 fields)
• netapp.googleapis.com/HostGroup (5 fields)
• netapp.googleapis.com/KmsConfig (3 fields)
• netapp.googleapis.com/QuotaRule (4 fields)
• netapp.googleapis.com/Replication (11 fields)
• netapp.googleapis.com/Snapshot (2 fields)
• netapp.googleapis.com/StoragePool (21 fields)
• netapp.googleapis.com/Volume (77 fields)

Google Cloud VMware Engine

• vmwareengine.googleapis.com/Cluster (25 fields)
• vmwareengine.googleapis.com/ExternalAccessRule (12 fields)
• vmwareengine.googleapis.com/ExternalAddress (2 fields)
• vmwareengine.googleapis.com/NetworkPeering (10 fields)
• vmwareengine.googleapis.com/NetworkPolicy (5 fields)
• vmwareengine.googleapis.com/PrivateCloud (41 fields)
• vmwareengine.googleapis.com/PrivateConnection (5 fields)
• vmwareengine.googleapis.com/VmwareEngineNetwork (2 fields)

Identity and Access Management

• iam.googleapis.com/AllowPolicy (2 fields)
• iam.googleapis.com/ServiceAccount
• iam.googleapis.com/ServiceAccountKey
• iam.googleapis.com/WorkloadIdentityPool (13 fields)
• iam.googleapis.com/WorkloadIdentityPoolManagedIdentity (3 fields)
• iam.googleapis.com/WorkloadIdentityPoolNamespace (3 fields)
• iam.googleapis.com/WorkloadIdentityPoolProvider (15 fields)
• iam.googleapis.com/WorkloadIdentityPoolProviderKey (3 fields)

Identity Platform

• identitytoolkit.googleapis.com/Config
• identitytoolkit.googleapis.com/DefaultSupportedIdpConfig
• identitytoolkit.googleapis.com/InboundSamlConfig
• identitytoolkit.googleapis.com/OauthIdpConfig
• identitytoolkit.googleapis.com/Tenant

Identity-Aware Proxy

• iap.googleapis.com/TunnelDestGroup (3 fields)

Infrastructure Manager

• config.googleapis.com/Deployment (12 fields)
• config.googleapis.com/Preview (12 fields)

Integration Connectors

• connectors.googleapis.com/Connection (206 fields)
• connectors.googleapis.com/EndpointAttachment (3 fields)
• connectors.googleapis.com/EventSubscription (29 fields)
• connectors.googleapis.com/ManagedZone (4 fields)
• connectors.googleapis.com/RegionalSettings (3 fields)

Knowledge Catalog

• dataplex.googleapis.com/AspectType (18 fields)
• dataplex.googleapis.com/DataScan (46 fields)
• dataplex.googleapis.com/EntryGroup (2 fields)
• dataplex.googleapis.com/EntryType (7 fields)
• dataplex.googleapis.com/MetadataJob (15 fields)

Live Stream API

• livestream.googleapis.com/Asset (4 fields)
• livestream.googleapis.com/Channel (65 fields)
• livestream.googleapis.com/Input (12 fields)

Managed Service for Apache Airflow

• composer.googleapis.com/Environment (41 fields)

Managed Service for Apache Kafka

• managedkafka.googleapis.com/ConnectCluster (8 fields)

Managed Service for Apache Spark

• dataproc.googleapis.com/Batch (37 fields)
• dataproc.googleapis.com/Cluster (40 fields)
• dataproc.googleapis.com/Session (23 fields)
• dataproc.googleapis.com/SessionTemplate (22 fields)

Memorystore

• redis.googleapis.com/Instance (26 fields)

Memorystore for Redis Cluster

• redis.googleapis.com/Cluster (25 fields)

Network Connectivity

• networkconnectivity.googleapis.com/Group (2 fields)
• networkconnectivity.googleapis.com/Hub (4 fields)
• networkconnectivity.googleapis.com/InternalRange (15 fields)
• networkconnectivity.googleapis.com/RegionalEndpoint (6 fields)
• networkconnectivity.googleapis.com/Spoke (29 fields)

Private Service Connect

• compute.googleapis.com/NetworkAttachment
• compute.googleapis.com/ServiceAttachment

Privileged Access Manager

• privilegedaccessmanager.googleapis.com/Entitlement (11 fields)
• privilegedaccessmanager.googleapis.com/Grant (4 fields)

Pub/Sub

• pubsub.googleapis.com/Schema (3 fields)
• pubsub.googleapis.com/Snapshot (3 fields)
• pubsub.googleapis.com/Subscription (44 fields)
• pubsub.googleapis.com/Topic (41 fields)

reCAPTCHA

• recaptchaenterprise.googleapis.com/FirewallPolicy (7 fields)
• recaptchaenterprise.googleapis.com/Key (18 fields)

Resource Manager

• cloudresourcemanager.googleapis.com/Folder (2 fields)
• cloudresourcemanager.googleapis.com/Project (2 fields)

Secret Manager

• secretmanager.googleapis.com/Secret (7 fields)

Secure Source Manager

• securesourcemanager.googleapis.com/Instance (6 fields)

Security Command Center

• securitycenter.googleapis.com/BigQueryExport (3 fields)
• securitycenter.googleapis.com/ContainerThreatDetectionSettings (3 fields)
• securitycenter.googleapis.com/EventThreatDetectionSettings (3 fields)
• securitycenter.googleapis.com/MuteConfig (4 fields)
• securitycenter.googleapis.com/NotificationConfig (3 fields)
• securitycenter.googleapis.com/ResourceValueConfig (8 fields)
• securitycenter.googleapis.com/SecurityHealthAnalyticsSettings (3 fields)
• securitycenter.googleapis.com/VirtualMachineThreatDetectionSettings (3 fields)
• securitycenter.googleapis.com/WebSecurityScannerSettings (3 fields)
• securitycentermanagement.googleapis.com/EventThreatDetectionCustomModule (5 fields)
• securitycentermanagement.googleapis.com/SecurityCenterService (3 fields)
• securitycentermanagement.googleapis.com/SecurityHealthAnalyticsCustomModule (8 fields)

security posture

• securityposture.googleapis.com/Posture (41 fields)
• securityposture.googleapis.com/PostureDeployment (6 fields)

Serverless VPC Access

• vpcaccess.googleapis.com/Connector (2 fields)

Service Extensions

• networkservices.googleapis.com/LbRouteExtension (12 fields)
• networkservices.googleapis.com/LbTrafficExtension (12 fields)

Service Management

• servicemanagement.googleapis.com/Service (133 fields)

Service Networking

• servicenetworking.googleapis.com/Connection (2 fields)

Spanner

• spanner.googleapis.com/Backup (4 fields)
• spanner.googleapis.com/Database (2 fields)
• spanner.googleapis.com/Instance (13 fields)
• spanner.googleapis.com/InstanceConfig (7 fields)

Storage Transfer Service

• storagetransfer.googleapis.com/TransferJob (102 fields)

Vector Search

• aiplatform.googleapis.com/Index (6 fields)
• aiplatform.googleapis.com/IndexEndpoint (9 fields)

Vertex AI

• aiplatform.googleapis.com/DeploymentResourcePool (13 fields)
• aiplatform.googleapis.com/Endpoint (35 fields)

Vertex AI Pipelines

• aiplatform.googleapis.com/PipelineJob (21 fields)

Vertex ML Metadata

• aiplatform.googleapis.com/MetadataStore (3 fields)

Video Stitcher API

• videostitcher.googleapis.com/CdnKey (4 fields)
• videostitcher.googleapis.com/LiveConfig (4 fields)
• videostitcher.googleapis.com/Slate (2 fields)
• videostitcher.googleapis.com/VodConfig (4 fields)

Virtual Private Cloud

• compute.googleapis.com/Address (11 fields)
• compute.googleapis.com/Network (21 fields)
• compute.googleapis.com/PacketMirroring (12 fields)
• compute.googleapis.com/Route (11 fields)
• compute.googleapis.com/Subnetwork (18 fields)

Web Security Scanner

• websecurityscanner.googleapis.com/ScanConfig (20 fields)

Workflows

• workflows.googleapis.com/Workflow (9 fields)

Automation

This repository includes a GitHub Actions workflow that scrapes the GCP documentation for the list of supported custom constraint resource types and their fields. The workflow runs daily and updates custom_constraints.json with the latest information.

To execute the scraper locally:

pip install -r requirements.txt
python scrape_gcp_custom_constraints.py

The output JSON has the following structure:

{
  "constraints": [
    {
      "service": "Service name",
      "resource_type": "Resource type string",
      "launch_status": "GA/Preview/...",
      "doc_url": "Documentation URL",
      "fields": [
        "resource.field1",
        "resource.field2",
        ...
      ]
    }
  ]
}

Each entry describes a GCP resource type that supports custom constraints, including the service, resource type, launch status, documentation link, and a list of available fields for use in custom constraints.

If the scraper cannot map a resource type or field as expected, it will exit with an error so the workflow fails.