Organization policy constraint violated Google Cloud / Firebase Origin: Platform & cloud Last updated 4 Nov 2026

Google Cloud: Constraint constraints/compute.vmExternalIpAccess violated for project — Request violates constraint 'constraints/...'

An organisation policy forbids what you asked (external IP on a VM, public bucket, allowed regions, public Cloud Run).

Exact message you may see Constraint constraints/compute.vmExternalIpAccess violated for projectRequest violates constraint 'constraints/Operation denied by org policy: constraints/FAILED_PRECONDITION Organization Policy constraintone or more organization policy constraints violated
Explore the map of this error Full error map →
Seen on: Google Cloud

Meaning

The error names the constraint. Inspect it with gcloud org-policies describe; the fix is to comply (e.g. use a private IP + Cloud NAT, choose an allowed region) or ask an Org Policy Administrator to grant an exception at project/folder level. Don't try to work around security constraints.

Common causes

  • constraints/compute.vmExternalIpAccess blocking external IPs
  • constraints/gcp.resourceLocations restricting regions
  • iam.allowedPolicyMemberDomains blocking allUsers
  • storage.publicAccessPrevention enforced
  • run.allowedIngress / ingress settings

⚡ Quick fix

  1. Use a compliant configuration (private IPs, allowed region)
  2. Ask an org policy admin for a project-level exception
  3. Read the constraint: gcloud org-policies describe CONSTRAINT --project PROJECT --effective

Detailed fix by platform

gcloud

  1. gcloud org-policies describe constraints/compute.vmExternalIpAccess --project PROJECT --effective

How to diagnose

  1. Constraint — Name in message?
  2. Scope — Org, folder, project?
  3. Option — Compliant design?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):

API has not been used in project before or it is disabled — Google Cloud: 403 SERVICE_DISABLED — Cloud Resource Manager API has not been used in project 123456 before or it is disabled. Enable it by visiting (Google Cloud / Firebase)API has not been used…Artifact Registry: Permission artifactregistry.repositories.uploadArtifacts denied — Docker push: denied: Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/p/locations/l/repositories/r" (Google Cloud / Firebase)Artifact Registry: Pe…BigQuery: Access Denied: Project: User does not have bigquery.jobs.create permission — BigQuery: Access Denied: Project my-project: User does not have bigquery.jobs.create permission in project my-project (Google Cloud / Firebase)BigQuery: Access Deni…Cloud Run 403: Your client does not have permission to get URL — Cloud Run: Error: Forbidden — Your client does not have permission to get URL / from this server (Google Cloud / Firebase)Cloud Run 403: Your c…Key creation is not allowed on this service account — GCP: FAILED_PRECONDITION: Key creation is not allowed on this service account (constraints/iam.disableServiceAccountKeyCreation) (Google Cloud / Firebase)Key creation is not a…PERMISSION_DENIED: Permission 'x' denied on resource — Google Cloud: 403 PERMISSION_DENIED — Permission 'storage.objects.get' denied on resource (or it may not exist) (Google Cloud / Firebase)PERMISSION_DENIED: Pe…Your active project does not match the quota project in your local ADC — gcloud/ADC: WARNING: Your active project does not match the quota project in your local Application Default Credentials file (Google Cloud / Firebase)Your active project d…Organizat…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.