Custom organization policy constraints

This page shows you how to use Google Cloud Organization Policy Service custom constraints to restrict specific operations on the following Cloud Storage for Firebase resources:

• firebasestorage.googleapis.com/DefaultBucket

To learn more about Organization Policy, see Custom organization policies.

About organization policies and constraints

The Google Cloud Organization Policy Service gives you centralized, programmatic control over your organization's resources. As the organization policy administrator, you can define an organization policy, which is a set of restrictions called constraints that apply to Google Cloud resources and descendants of those resources in the Google Cloud resource hierarchy. You can enforce organization policies at the organization, folder, or project level.

Organization Policy provides built-in managed constraints for various Google Cloud services. However, if you want more granular, customizable control over the specific fields that are restricted in your organization policies, you can also create custom constraints and use those custom constraints in an organization policy.

Policy inheritance

By default, organization policies are inherited by the descendants of the resources on which you enforce the policy. For example, if you enforce a policy on a folder, Google Cloud enforces the policy on all projects in the folder. To learn more about this behavior and how to change it, refer to Hierarchy evaluation rules.

In addition, because Cloud Storage for Firebase stores files in underlying Cloud Storage buckets, any organization policies or custom constraints enforced on Cloud Storage resources also apply to your Cloud Storage for Firebase buckets.

Benefits

• Security and governance: Enforce centralized organizational control over Cloud Storage bucket provisioning to ensure compliance with data residency and cost management guardrails.
• Fine-grained attribute control: Restrict default bucket creation based on specific resource attributes such as storageClass or location.

Limitations

The following limitations apply when using custom organization policies with Cloud Storage for Firebase:

• No retroactive enforcement: Newly enforced custom constraints don't apply to existing resources. Existing default buckets aren't evaluated unless they are updated. To identify existing resources that might violate a constraint, you can test policies using dry-run mode.
• Access control restrictions: Custom constraints can't restrict access control lists (ACLs) or IAM policies on buckets.

Before you begin

1. In the Firebase console, select or create a Firebase project.

   Ensure that your project is part of an organization and that you know your organization ID.

2. To set up and enforce custom constraints using the command line, install the Google Cloud CLI (gcloud). Custom organization policies cannot be managed using the Firebase CLI.

Required roles

To get the permissions that you need to manage custom organization policies, ask your administrator to grant you the Organization Policy Administrator (roles/orgpolicy.policyAdmin) IAM role on the organization.

Cloud Storage for Firebase supported resources

The following table lists the Cloud Storage for Firebase resources that you can reference in custom constraints. You can also reference Cloud Storage supported resources, since custom constraints on those resources also apply to Cloud Storage for Firebase buckets.

Set up a custom constraint

A custom constraint is defined in a YAML file by the resources, methods, conditions, and actions that are supported by the service on which you are enforcing the organization policy. Conditions for your custom constraints are defined using Common Expression Language (CEL) . For more information about how to build conditions in custom constraints using CEL, see the CEL section of Creating and managing custom constraints.

Enforce a custom organization policy

You can enforce a constraint by creating an organization policy that references it, and then applying that organization policy to a Google Cloud resource.

Test the custom organization policy

The following example creates a custom constraint and policy that require all newly created default buckets to avoid using the STANDARD storage class. You can test the policy by trying to take an action that the policy should prevent.

Create the constraint

1. Save the following file as constraint-restrict-storage-class.yaml:

   name: organizations/ORGANIZATION_ID/customConstraints/custom.restrictStorageClass
   resourceTypes:
   -   firebasestorage.googleapis.com/DefaultBucket
   methodTypes:
   -   CREATE
   condition: "resource.storageClass == 'STANDARD'"
   actionType: DENY
   displayName: Restrict Standard Storage Class
   description: Deny creating buckets with STANDARD storage class.
   

   Replace ORGANIZATION_ID with your organization ID.

2. Apply the constraint:

   gcloud org-policies set-custom-constraint ~/constraint-restrict-storage-class.yaml
   

3. Verify that the constraint exists:

   gcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID
   

   The output is similar to the following:

   CUSTOM_CONSTRAINT            ACTION_TYPE   METHOD_TYPES   RESOURCE_TYPES                                 DISPLAY_NAME
   custom.restrictStorageClass  DENY          CREATE         firebasestorage.googleapis.com/DefaultBucket   Restrict Standard Storage Class
   ...
   

Create the policy

1. Save the following file as policy-restrict-storage-class.yaml:

   name: projects/PROJECT_ID/policies/custom.restrictStorageClass
   spec:
     rules:
     -   enforce: true
   

   Replace PROJECT_ID with your project ID.

2. Apply the policy:

   gcloud org-policies set-policy ~/policy-restrict-storage-class.yaml
   

3. Verify that the policy exists:

   gcloud org-policies list --project=PROJECT_ID
   

   The output is similar to the following:

   CONSTRAINT                   LIST_POLICY    BOOLEAN_POLICY    ETAG
   custom.restrictStorageClass  -              SET               CIqktscGELiZn6cC-
   

After you apply the policy, wait for about two minutes for Google Cloud to start enforcing the policy.

Test the policy

Try to create a default bucket using the Cloud Storage for Firebase REST API without specifying a storage class (which defaults to STANDARD):

PROJECT_ID="PROJECT_ID"
TOKEN=$(gcloud auth print-access-token)

curl -X POST "https://firebasestorage.googleapis.com/v1beta/projects/${PROJECT_ID}/defaultBucket" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"location": "US-EAST1"}'

The request fails with an error similar to the following:

FAILED_PRECONDITION: Operation denied by org policy: ["customConstraints/custom.restrictStorageClass": "Deny creating buckets with STANDARD storage class."].
-   '@type': type.googleapis.com/google.rpc.ErrorInfo
  domain: iam.googleapis.com
  metadata:
    customConstraints: customConstraints/custom.restrictStorageClass
  reason: CUSTOM_ORG_POLICY_VIOLATION

Example custom organization policies for common use cases

This table provides syntax examples for some common custom constraints.

name: organizations/ORGANIZATION_ID/customConstraints/custom.restrictStorageClass
resourceTypes:
-   firebasestorage.googleapis.com/DefaultBucket
methodTypes:
-   CREATE
condition: "resource.storageClass == 'STANDARD'"
actionType: DENY
displayName: Restrict Standard Storage Class
description: Deny creating buckets with STANDARD storage class.

name: organizations/ORGANIZATION_ID/customConstraints/custom.requireDefaultBucketLocation
resourceTypes:
-   firebasestorage.googleapis.com/DefaultBucket
methodTypes:
-   CREATE
condition: "resource.location != 'US-EAST1'"
actionType: DENY
displayName: Require US-EAST1 Location
description: Deny creating default buckets outside the US-EAST1 location.

What's next

• Learn more about Organization Policy Service.
• Learn more about how to create and manage organization policies.
• See the full list of managed organization policy constraints.