Manage data lineage resources using custom constraints

You can use Google Cloud Organization Policy custom constraints to restrict specific operations on data lineage resources. Although Organization Policy provides predefined constraints for various Google Cloud services, custom constraints let you to define granular control over specific fields in your organization policies.

About Google Cloud Organization Policy

Google Cloud Organization Policy gives you centralized, programmatic control over your organization's resources. As the organization policy administrator, you can define an organization policy, which is a set of restrictions called constraints that apply to Google Cloud resources and descendants of those resources in the Google Cloud resource hierarchy. You can enforce organization policies at the organization, folder, or project level.

Benefits

Custom organization policies provide more granular, customizable control over the specific fields that are restricted in your organization policies.

You can use a custom organization policy to allow or deny the creation of data lineage processes with conditions based on supported resource attributes, such as process name, source type, and origin.

For more information, see predefined constraints.

Policy inheritance

By default, organization policies are inherited by the descendants of the resources on which you enforce the policy. For example, if you enforce a policy on a folder, Google Cloud enforces the policy on all projects in the folder. To learn more about this behavior and how to change it, refer to Hierarchy evaluation rules.

Pricing

The Organization Policy Service, including predefined and custom organization policies, is offered at no charge.

Limitations

• Custom constraints can be enforced only for data lineage Process resources. Other resources, such as Runs and Events, aren't supported.

• Newly enforced custom constraints don't apply to existing resources.

Before you begin

• Ensure that you know your organization ID.

• If you want to test custom organization policies that reference data lineage resources, create a new project. Testing these organization policies in an existing project could disrupt security workflows.

  1. Ensure that you have the Project Creator IAM role (roles/resourcemanager.projectCreator). Learn how to grant roles.

  2. In the Google Cloud console, go to the project selector page.

     Go to project selector

  3. Click Create project.

  4. Name your project. Make a note of your generated project ID.

  5. Edit the other fields as needed.

  6. Click Create.

Required roles

To get the permissions that you need to manage organization policies, ask your administrator to grant you the Organization Policy Administrator (roles/orgpolicy.policyAdmin) IAM role on the organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to manage organization policies. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to manage organization policies:

• orgpolicy.constraints.list
• orgpolicy.customConstraints.create
• orgpolicy.customConstraints.delete
• orgpolicy.customConstraints.get
• orgpolicy.customConstraints.list
• orgpolicy.customConstraints.update
• orgpolicy.policies.create
• orgpolicy.policies.delete
• orgpolicy.policies.list
• orgpolicy.policies.update
• orgpolicy.policy.get
• orgpolicy.policy.set

You might also be able to get these permissions with custom roles or other predefined roles.

Create a custom constraint

You define a custom constraint in a YAML file by specifying the resources, methods, conditions, and actions supported by the service on which you are enforcing the organization policy. Conditions for your custom constraints are defined using Common Expression Language (CEL). For more information about how to build conditions in custom constraints using CEL, see the CEL section of