# Google Cloud: Constraint constraints/compute.vmExternalIpAccess violated for project — Request violates constraint 'constraints/...'

**Code:** `Organization policy constraint violated` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud

An organisation policy forbids what you asked (external IP on a VM, public bucket, allowed regions, public Cloud Run).

## Meaning

The error names the constraint. Inspect it with `gcloud org-policies describe`; the fix is to comply (e.g. use a private IP + Cloud NAT, choose an allowed region) or ask an Org Policy Administrator to grant an exception at project/folder level. Don't try to work around security constraints.

## Common causes

- constraints/compute.vmExternalIpAccess blocking external IPs
- constraints/gcp.resourceLocations restricting regions
- iam.allowedPolicyMemberDomains blocking allUsers
- storage.publicAccessPrevention enforced
- run.allowedIngress / ingress settings

## Quick fix

1. Use a compliant configuration (private IPs, allowed region)
2. Ask an org policy admin for a project-level exception
3. Read the constraint: `gcloud org-policies describe CONSTRAINT --project PROJECT --effective`

## Detailed fix by platform

### gcloud

1. `gcloud org-policies describe constraints/compute.vmExternalIpAccess --project PROJECT --effective`

## How to diagnose

1. **Constraint** — Name in message?
2. **Scope** — Org, folder, project?
3. **Option** — Compliant design?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/org-policy-constraint-violated)