1. Open the GCP console and navigate to the IAM & admin page.
2. Select the project for which you want to restrict the creation of cloud resources.
3. Click on the “Edit” button next to the “Service Accounts” section.
4. Locate the service account that you want to restrict and click on the “Edit” button next to it.
5. Scroll down to the “Service Account Permissions” section and click on the “Add Another” button.
6. In the “Add Permission” dialog box, select “Cloud Resource Manager API” from the “Select a service” dropdown menu.
7. In the “Select a role” dropdown menu, select “Cloud Resource Manager Editor” or “Cloud Resource Manager Viewer” depending on the level of access you want to grant.
8. In the “Select a resource” dropdown menu, select “All resources in the selected project”.
9. In the “Condition” section, click on the “Add Condition” button.
10. In the “Add Condition” dialog box, select “Location” from the “Attribute” dropdown menu.
11. In the “Operator” dropdown menu, select “is not one of”.
12. In the “Value” field, enter the list of allowed locations separated by commas (e.g. us-central1, us-west1, europe-west1).
13. Click on the “Save” button to save the changes.

​

1. Open the GCP Cloud Shell by clicking on the icon in the top right-hand corner of the GCP console.
2. In the Cloud Shell, enter the following command to list the current organization policy constraints:
   gcloud resource-manager org-policies list
   
3. Identify the policy constraint that needs to be updated to restrict the creation of cloud resources to specific locations.
4. Enter the following command to get the details of the policy constraint:
   gcloud resource-manager org-policies describe [CONSTRAINT]
   
   Replace [CONSTRAINT] with the name of the policy constraint.
5. Determine the locations to which you want to restrict the creation of cloud resources.
6. Enter the following command to update the policy constraint to restrict the creation of cloud resources to the specified locations:
   gcloud resource-manager org-policies update [CONSTRAINT] \
   --enforced-list=locations/[LOCATION1],locations/[LOCATION2],...
   
   Replace [CONSTRAINT] with the name of the policy constraint and [LOCATION1], [LOCATION2], etc. with the locations to which you want to restrict the creation of cloud resources.
7. Verify that the policy constraint has been updated by entering the following command:
   gcloud resource-manager org-policies describe [CONSTRAINT]
   
   Replace [CONSTRAINT] with the name of the policy constraint.

1. First, you need to set up a GCP project and install the necessary Python libraries. You can use the google-cloud-resource-manager library to manage GCP resources.
2. Next, you need to create a configuration file that specifies the allowed locations where resources can be created. For example, you can create a config.yaml file that looks like this:

allowed_locations:
  - us-central1
  - us-east1
  - europe-west1

3. In your Python script, you can read the configuration file and use it to validate the location of the resources being created. Here’s an example code snippet:

import yaml
from google.cloud import resource_manager

# Read the configuration file
with open('config.yaml', 'r') as f:
    config = yaml.safe_load(f)

# Initialize the resource manager client
client = resource_manager.Client()

# Define a function to validate the location of a resource
def validate_location(resource_type, location):
    if location not in config['allowed_locations']:
        raise ValueError(f"Cannot create {resource_type} in location {location}. Allowed locations are: {', '.join(config['allowed_locations'])}")

# Example usage: create a new GCE instance
instance = client.compute.instances().insert(
    project='my-project',
    zone='us-central1-a',
    body={
        'name': 'my-instance',
        'machineType': 'n1-standard-1',
        'disks': [{
            'boot': True,
            'autoDelete': True,
            'initializeParams': {
                'sourceImage': 'projects/debian-cloud/global/images/family/debian-10',
            }
        }],
        'networkInterfaces': [{
            'network': 'global/networks/default',
            'accessConfigs': [{
                'type': 'ONE_TO_ONE_NAT',
                'name': 'External NAT'
            }]
        }],
    }
).execute()

# Validate the location of the new instance
validate_location('GCE instance', instance['zone'].split('/')[-1])

4. You can repeat this validation for other types of resources as well, such as GCS buckets or Cloud Functions.

resource "google_org_policy_policy" "restrict_resource_locations" {
  parent   = "organizations/ORGANIZATION_ID" # replace with your numeric org ID, e.g. "organizations/123456789012"
  name     = "organizations/ORGANIZATION_ID/policies/constraints/gcp.resourceLocations"

  spec {
    rules {
      values {
        # Replace with the locations you want to allow.
        # Examples:
        # - "in:us-locations"
        # - "in:eu-locations"
        # - "us-central1", "us-east1", "europe-west1"
        allowed_values = [
          "in:ALLOWED_LOCATION_GROUP_OR_REGION_1",
          "in:ALLOWED_LOCATION_GROUP_OR_REGION_2",
        ]
      }
    }

    # Optional: ensure the policy is enforced (not just suggested)
    inherit_from_parent = false
    reset               = false
  }
}

• ORGANIZATION_ID with your org numeric ID.
• ALLOWED_LOCATION_GROUP_OR_REGION_1/2 with the specific region groups or regions you want to allow.