A Constraint that Is Enforced rather than Rehearsed
dry_run_spec is a separate configuration from spec and only spec enforces, so a dry-run policy appears in the console, evaluates everything and denies nothing. inherit_from_parent defaults to false, which makes a local addition silently REPLACE the organization policy rather than add to it.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "org_policy" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-org-policy/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/gcp-org-policy?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Constraint that Is Enforced rather than Rehearsed](https://www.iac-bazaar.com/catalog/gcp-org-policy?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "org_policy" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-org-policy/gcp"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-org-policy
An organization policy constraint that is enforced rather than rehearsed. Works
with Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
dry_run_spec is a separate configuration from spec, and only spec
enforces. A policy with only a dry-run spec appears in the console, evaluates
every resource, writes violations to the audit log - and denies nothing. It is
the correct way to introduce a constraint across an organization somebody else
operates, and it is indistinguishable from an enforced policy unless you look at
which of the two blocks is populated. This module writes to one or the other,
never both, so the distinction is a single variable rather than a shape you have
to read.
inherit_from_parent = false silently drops the parent's policy. On a list
constraint it means this scope's values replace the organization's rather
than adding to them - so a project that allows two extra regions can also, in
the same edit, stop enforcing the twelve the organization denied. Google
defaults it to false and the effect is invisible at the point of use, so this
module defaults it to true and a precondition refuses the other way
without an explicit statement.
enforce, allow_all and deny_all are strings. "TRUE" and "FALSE",
not booleans, because the API models a tri-state - set true, set false, unset -
that a bool cannot carry. Passing a real boolean fails with a message that does
not explain why, so a precondition says so plainly.
A boolean constraint with enforce = "FALSE" is not "no policy". It
actively turns the constraint off for this scope, overriding an inherited
enforcement. That is a real and sometimes necessary thing to do, and in a diff
it looks identical to simply not having a policy - so it needs
accept_disabling_constraint to say which one you meant.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-billing-budget
The API accepts a budget with default recipients disabled and no channel, topic or threshold rule - a number that is tracked and never sent anywhere. Refuses that, insists on a FORECASTED_SPEND rule, and defaults credit_types_treatment to EXCLUDE_ALL_CREDITS, because a budget that counts credits measures your runway, not your spend, and looks healthy until the month they run out.
gcp-project-factory
Opinionated project creation: API enablement, billing budget, default-SA lockdown, audit log sinks and baseline IAM.
gcp-resource-tags
Tag keys and values are definitions; conditional IAM, organisation policies and firewall rules read bindings, and a tag bound to nothing governs nothing while appearing fully defined. Bindings come with the keys - to folders, so every project beneath inherits - and the values that attach nowhere are listed in an output, along with the namespaced names conditions need.
gcp-essential-contacts
Without Essential Contacts, security notices, suspension warnings, billing problems and API shutdowns go to whoever holds Owner - a service account and an alias nobody reads - and the list is empty by default. Contacts per category, with a refusal when any category is left uncovered and an output naming the ones that still fall through to the Owner path.
oci-security-zone
The opposite of every other guardrail here: a security zone does not detect or report, it REFUSES - the API call fails. There is no dry-run mode. So the risk inverts too: applied to a compartment that already holds non-compliant resources, the team that owns them discovers they can no longer change them.
tencent-org-policy
A Tencent Cloud Organization service control policy and its attachments. It refuses a policy attached to nothing, an allow statement read as a grant, and an unasked-for root attachment. Destroying the policy-type switch disables every control policy in the organisation, so the module leaves it alone by default and protects it from destroy when asked to manage it.