A Constraint that Is Enforced rather than Rehearsed
dry_run_spec is a separate configuration from spec and only spec enforces, so a dry-run policy appears in the console, evaluates everything and denies nothing. inherit_from_parent defaults to false, which makes a local addition silently REPLACE the organization policy rather than add to it.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "org_policy" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-org-policy/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-org-policy
An organization policy constraint that is enforced rather than rehearsed. Works
with Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
dry_run_spec is a separate configuration from spec, and only spec
enforces. A policy with only a dry-run spec appears in the console, evaluates
every resource, writes violations to the audit log - and denies nothing. It is
the correct way to introduce a constraint across an organization somebody else
operates, and it is indistinguishable from an enforced policy unless you look at
which of the two blocks is populated. This module writes to one or the other,
never both, so the distinction is a single variable rather than a shape you have
to read.
inherit_from_parent = false silently drops the parent's policy. On a list
constraint it means this scope's values replace the organization's rather
than adding to them - so a project that allows two extra regions can also, in
the same edit, stop enforcing the twelve the organization denied. Google
defaults it to false and the effect is invisible at the point of use, so this
module defaults it to true and a precondition refuses the other way
without an explicit statement.
enforce, allow_all and deny_all are strings. "TRUE" and "FALSE",
not booleans, because the API models a tri-state - set true, set false, unset -
that a bool cannot carry. Passing a real boolean fails with a message that does
not explain why, so a precondition says so plainly.
A boolean constraint with enforce = "FALSE" is not "no policy". It
actively turns the constraint off for this scope, overriding an inherited
enforcement. That is a real and sometimes necessary thing to do, and in a diff
it looks identical to simply not having a policy - so it needs
accept_disabling_constraint to say which one you meant.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage