We are migrating some workloads from Azure to GCP and in Azure we have Azure policy which requires resources to have contact tag and value of the tag shall be ending with @company.com, so no resources can be created without that tag being present.
I tried to perform the same in GCP and it does not seem to work, tag with dynamic values does not seem to be attached to new resources at all.
Environment is
Tag key [removed by moderator] /Product (tagKeys/ [removed by moderator] ): predefined values, e.g. DevOps
Tag key [removed by moderator] /contact (tagKeys/ [removed by moderator] ): dynamic values, allowedValuesRegex: ^[A-Za-z0-9._%+-]+@company[.]com$
My condition is
condition: resource.hasDirectTagKey(" [removed by moderator] /Product") && resource.hasDirectTagKey(" [removed by moderator] /contact")
methodTypes: [GOVERN_TAGS]
resourceTypes: [compute.googleapis.com/Instance]
actionType: ALLOW
Step to reproduce
gcloud compute instances create tag-test --project comp-dev1 --zone us-east1-b --machine-type e2-micro --resource-manager-tags=" [removed by moderator] /Product=DevOps, [removed by moderator] /contact= [removed by moderator] "
Actual result
FAILED_PRECONDITION: Operation disallowed by Organization Policy constraint due to missing or incorrect Tags
customConstraints/custom.requireProductAndContactTags ... Allows governed GCP resource create and update requests only when Product and contact tags are directly attached.
