Setting up trusted image policies

By default, users in your project can create persistent disks or copyimages using any of thepublic imagesand any images thatprincipals can access through IAM roles.However, in some situations you might want to restrict principals so that theycan create boot disks only from images that contain approved software that meetsyour policy or security requirements.

Use the Trusted image feature to define an organization policy thatallows principals to create persistent disks only from images in specificprojects.

To restrict the locations where your images can be used, readrestricting use of your shared images, disks, and snapshots.

Before you begin

Limitations

  • Trusted image policies do not restrict access to the following images:

    • Custom images in your local project.

    • Image files in Cloud Storage buckets.

  • Trusted image policies do not prevent users from creating image resources intheir local projects.

Set image access constraints

Enact an image access policy by setting acompute.trustedImageProjectsconstraint on your project, your folder, or your organization. You must havepermission to modify organization policies to set these constraints. Forexample,roles/orgpolicy.policyAdminhas permission to set these constraints. For more information about managingpolicies at the project, folder, or organization level, seeUsing constraints.

You can set constraints on all public images available on Compute Engine.For a list of image project names, seeOperating systems details.You can also restrict the Machine Learning (ML) images that are available onCompute Engine by using theml-images project. If you are usingServerless VPC Access,grant your project permission to use Compute Engine VM images from theserverless-vpc-access-images project.

Use the Google Cloud console or Google Cloud CLI to set constraints on image access.

Console

For example, to set a constraint at the project level, do the following:

  1. Go to theOrganization policies page.

    Go to Organization policies

  2. From the policies list, clickDefine trusted image projects.ThePolicy details page displays.

  3. On thePolicy details page, clickManage Policy. TheEdit policypage displays.

  4. On theEdit policy page, selectCustomize.

  5. ForPolicy enforcement, select an enforcement option. For informationabout inheritance and the resource hierarchy, seeUnderstanding Hierarchy Evaluation.

  6. ClickAdd rule.

  7. In thePolicy values list, you can select whether this organizationpolicy should allow access to all image projects, deny access to all imageprojects, or you can specify a custom set of projects to allow or denyaccess to.

    To set the policy rule, complete one of the following options:

    • To allow users to create boot disks from all public images,selectAllow All.
    • To restrict users from creating boot disk from all public images,selectDeny All.

    • To specify a select set of public images that users can create bootdisks from, selectCustom.APolicy type andCustom values field displays.

      1. In thePolicy type list, selectAllow orDeny.

      2. In theCustom values field, enter the name of the image projectusing theprojects/IMAGE_PROJECT format.

        ReplaceIMAGE_PROJECT with the image projectyou want to set the constraint on.

        You can add multiple image projects. For each image project thatyou want to add, clickAdd and enter the image project name.

  8. To save the rule, clickDone.

  9. To save and apply the organization policy, clickSave.

For more information about creating organization policies, seeCreating and managing organization policies.

gcloud

For example, to set a constraint at the project level, do the following:

  1. Get the existing policy settings for your project by using theresource-manager org-policies describe command.

    gcloud resource-manager org-policies describe \   compute.trustedImageProjects --project=PROJECT_ID \   --effective > policy.yaml

    ReplacePROJECT_ID with your project ID.

  2. Open thepolicy.yaml file in a text editor and modify thecompute.trustedImageProjects constraint. Add the restrictions that youneed and remove the restrictions that you no longer require. When youhave finished editing the file, save your changes. For example,you might set the following constraint entry in your policy file:

    constraint: constraints/compute.trustedImageProjectslistPolicy: allowedValues:    - projects/debian-cloud    - projects/cos-cloud deniedValues:    - projects/IMAGE_PROJECT

    ReplaceIMAGE_PROJECT with the name of the image project that you want to restrict in your project.

    Optionally, you might want to deny access to all images outside ofthe custom images in your project. For that situation, use thefollowing example:

    constraint: constraints/compute.trustedImageProjectslistPolicy: allValues: DENY

  3. Apply thepolicy.yaml file to your project. If yourorganization or folder has existing constraints,those constraints might conflict with project-level constraints thatyou set. To apply the constraint, use theresource-manager org-policies set-policy command.

    gcloud resource-manager org-policies set-policy \   policy.yaml --project=PROJECT_ID

    ReplacePROJECT_ID with your project ID.

When you have finished configuring the constraints,test those constraints to ensure that they create the restrictions that youneed.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-18 UTC.