Update project/folder/module to use new org policies API and tf1.3 optionals.

modules/folder/README.md

@@ -259,7 +259,7 @@ module "folder" {
 | [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_folder_iam_binding</code> · <code>google_folder_iam_member</code> |
 | [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_folder_exclusion</code> · <code>google_logging_folder_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> · <code>google_folder</code> |
-| [organization-policies.tf](./organization-policies.tf) | Folder-level organization policies. | <code>google_folder_organization_policy</code> |
+| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
 | [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> |
 | [variables.tf](./variables.tf) | Module variables. |  |
@@ -282,10 +282,9 @@ module "folder" {
 | [logging_exclusions](variables.tf#L98) | Logging exclusions for this folder in the form {NAME -> FILTER}. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
 | [logging_sinks](variables.tf#L105) | Logging sinks to create for this folder. | <code title="map&#40;object&#40;&#123;&#10;  destination      &#61; string&#10;  type             &#61; string&#10;  filter           &#61; string&#10;  include_children &#61; bool&#10;  exclusions &#61; map&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [name](variables.tf#L126) | Folder name. | <code>string</code> |  | <code>null</code> |
-| [parent](variables.tf#L132) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> |  | <code>null</code> |
+| [org_policies](variables.tf#L132) | Organization policies applied to this folder keyed by policy name. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; optional&#40;bool&#41; &#35; for list policies only.&#10;  reset               &#61; optional&#40;bool&#41;&#10;  allow &#61; optional&#40;object&#40;&#123;&#10;    all    &#61; optional&#40;bool&#41;&#10;    values &#61; optional&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  deny &#61; optional&#40;object&#40;&#123;&#10;    all    &#61; optional&#40;bool&#41;&#10;    values &#61; optional&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  enforce &#61; optional&#40;bool, true&#41; &#35; for boolean policies only.&#10;  rules &#61; optional&#40;list&#40;object&#40;&#123;&#10;    allow &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    deny &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    enforce &#61; optional&#40;bool, true&#41; &#35; for boolean policies only.&#10;    condition &#61; object&#40;&#123;&#10;      description &#61; optional&#40;string&#41;&#10;      expression  &#61; optional&#40;string&#41;&#10;      location    &#61; optional&#40;string&#41;&#10;      title       &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [policy_boolean](variables.tf#L142) | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code>map&#40;bool&#41;</code> |  | <code>&#123;&#125;</code> |
+| [parent](variables.tf#L172) | Parent in folders/folder_id or organizations/org_id format. | <code>string</code> |  | <code>null</code> |
-| [policy_list](variables.tf#L149) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; bool&#10;  suggested_value     &#61; string&#10;  status              &#61; bool&#10;  values              &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [tag_bindings](variables.tf#L182) | Tag bindings for this folder, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
-| [tag_bindings](variables.tf#L161) | Tag bindings for this folder, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 
@@ -295,7 +294,7 @@ module "folder" {
 | [firewall_policy_id](outputs.tf#L21) | Map of firewall policy ids created in this folder. |  |
 | [folder](outputs.tf#L26) | Folder resource. |  |
 | [id](outputs.tf#L31) | Folder id. |  |
-| [name](outputs.tf#L41) | Folder name. |  |
+| [name](outputs.tf#L40) | Folder name. |  |
-| [sink_writer_identities](outputs.tf#L46) | Writer identities created for each sink. |  |
+| [sink_writer_identities](outputs.tf#L45) | Writer identities created for each sink. |  |
 
 <!-- END TFDOC -->

modules/folder/organization-policies.tf

@@ -16,75 +16,97 @@
 
 # tfdoc:file:description Folder-level organization policies.
 
-resource "google_folder_organization_policy" "boolean" {
+/**
-  for_each   = var.policy_boolean
+ * Copyright 2022 Google LLC
-  folder     = local.folder.name
+ *
-  constraint = each.key
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 
-  dynamic "boolean_policy" {
+# tfdoc:file:description Project-level organization policies.
-    for_each = each.value == null ? [] : [each.value]
-    iterator = policy
-    content {
-      enforced = policy.value
-    }
-  }
 
-  dynamic "restore_policy" {
+locals {
-    for_each = each.value == null ? [""] : []
+  org_policies = {
-    content {
+    for k, v in var.org_policies :
-      default = true
+    k => merge(v, {
-    }
+      is_boolean_policy = v.allow == null && v.deny == null
+      has_values = (
+        length(coalesce(try(v.allow.values, []), [])) > 0 ||
+        length(coalesce(try(v.deny.values, []), [])) > 0
+      )
+      rules = [
+        for r in v.rules :
+        merge(r, {
+          has_values = (
+            length(coalesce(try(r.allow.values, []), [])) > 0 ||
+            length(coalesce(try(r.deny.values, []), [])) > 0
+          )
+        })
+      ]
+    })
   }
 }
 
-resource "google_folder_organization_policy" "list" {
+resource "google_org_policy_policy" "default" {
-  for_each   = var.policy_list
+  for_each = local.org_policies
-  folder     = local.folder.name
+  name     = "${local.folder.name}/policies/${each.key}"
-  constraint = each.key
+  parent   = local.folder.name
 
-  dynamic "list_policy" {
+  spec {
-    for_each = each.value.status == null ? [] : [each.value]
+    inherit_from_parent = each.value.inherit_from_parent
-    iterator = policy
+    reset               = each.value.reset
-    content {
+
-      inherit_from_parent = policy.value.inherit_from_parent
+    rules {
-      suggested_value     = policy.value.suggested_value
+      allow_all = try(each.value.allow.all, null) == true ? "TRUE" : null
-      dynamic "allow" {
+      deny_all  = try(each.value.deny.all, null) == true ? "TRUE" : null
-        for_each = policy.value.status ? [""] : []
+      enforce = (
+        each.value.is_boolean_policy && each.value.enforce != null
+        ? upper(tostring(each.value.enforce))
+        : null
+      )
+      dynamic "values" {
+        for_each = each.value.has_values ? [1] : []
         content {
-          values = (
+          allowed_values = try(each.value.allow.values, null)
-            try(length(policy.value.values) > 0, false)
+          denied_values  = try(each.value.deny.values, null)
-            ? policy.value.values
-            : null
-          )
-          all = (
-            try(length(policy.value.values) > 0, false)
-            ? null
-            : true
-          )
         }
       }
-      dynamic "deny" {
+    }
-        for_each = policy.value.status ? [] : [""]
+
-        content {
+    dynamic "rules" {
-          values = (
+      for_each = each.value.rules
-            try(length(policy.value.values) > 0, false)
+      iterator = rule
-            ? policy.value.values
+      content {
-            : null
+        allow_all = try(rule.value.allow.all, false) == true ? "TRUE" : null
-          )
+        deny_all  = try(rule.value.deny.all, false) == true ? "TRUE" : null
-          all = (
+        enforce = (
-            try(length(policy.value.values) > 0, false)
+          each.value.is_boolean_policy && rule.value.enforce != null
-            ? null
+          ? upper(tostring(rule.value.enforce))
-            : true
+          : null
-          )
+        )
+        condition {
+          description = rule.value.condition.description
+          expression  = rule.value.condition.expression
+          location    = rule.value.condition.location
+          title       = rule.value.condition.title
+        }
+        dynamic "values" {
+          for_each = rule.value.has_values ? [1] : [0]
+          content {
+            allowed_values = try(rule.value.allow.values, null)
+            denied_values  = try(rule.value.deny.values, null)
+          }
         }
       }
     }
   }
-
-  dynamic "restore_policy" {
-    for_each = each.value.status == null ? [true] : []
-    content {
-      default = true
-    }
-  }
 }

modules/folder/outputs.tf

@@ -33,8 +33,7 @@ output "id" {
   value       = local.folder.name
   depends_on = [
     google_folder_iam_binding.authoritative,
-    google_folder_organization_policy.boolean,
+    google_org_policy_policy.default,
-    google_folder_organization_policy.list
   ]
 }
 

modules/folder/variables.tf

@@ -129,6 +129,46 @@ variable "name" {
   default     = null
 }
 
+variable "org_policies" {
+  description = "Organization policies applied to this folder keyed by policy name."
+  type = map(object({
+    inherit_from_parent = optional(bool) # for list policies only.
+    reset               = optional(bool)
+
+    # default (unconditional) values
+    allow = optional(object({
+      all    = optional(bool)
+      values = optional(list(string))
+    }))
+    deny = optional(object({
+      all    = optional(bool)
+      values = optional(list(string))
+    }))
+    enforce = optional(bool, true) # for boolean policies only.
+
+    # conditional values
+    rules = optional(list(object({
+      allow = optional(object({
+        all    = optional(bool)
+        values = optional(list(string))
+      }))
+      deny = optional(object({
+        all    = optional(bool)
+        values = optional(list(string))
+      }))
+      enforce = optional(bool, true) # for boolean policies only.
+      condition = object({
+        description = optional(string)
+        expression  = optional(string)
+        location    = optional(string)
+        title       = optional(string)
+      })
+    })), [])
+  }))
+  default  = {}
+  nullable = false
+}
+
 variable "parent" {
   description = "Parent in folders/folder_id or organizations/org_id format."
   type        = string
@@ -139,25 +179,6 @@ variable "parent" {
   }
 }
 
-variable "policy_boolean" {
-  description = "Map of boolean org policies and enforcement value, set value to null for policy restore."
-  type        = map(bool)
-  default     = {}
-  nullable    = false
-}
-
-variable "policy_list" {
-  description = "Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny."
-  type = map(object({
-    inherit_from_parent = bool
-    suggested_value     = string
-    status              = bool
-    values              = list(string)
-  }))
-  default  = {}
-  nullable = false
-}
-
 variable "tag_bindings" {
   description = "Tag bindings for this folder, in key => tag value id format."
   type        = map(string)

modules/organization-policy/main.tf

@@ -9,7 +9,7 @@
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * WITHOUT WARRANTIES OR CONDITIONSOF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

modules/organization/README.md

@@ -281,7 +281,7 @@ module "org" {
 | [iam.tf](./iam.tf) | IAM bindings, roles and audit logging resources. | <code>google_organization_iam_audit_config</code> · <code>google_organization_iam_binding</code> · <code>google_organization_iam_custom_role</code> · <code>google_organization_iam_member</code> · <code>google_organization_iam_policy</code> |
 | [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_organization_exclusion</code> · <code>google_logging_organization_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_essential_contacts_contact</code> |
-| [organization-policies.tf](./organization-policies.tf) | Organization-level organization policies. | <code>google_organization_policy</code> |
+| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
 | [tags.tf](./tags.tf) | None | <code>google_tags_tag_binding</code> · <code>google_tags_tag_key</code> · <code>google_tags_tag_key_iam_binding</code> · <code>google_tags_tag_value</code> · <code>google_tags_tag_value_iam_binding</code> |
 | [variables.tf](./variables.tf) | Module variables. |  |
@@ -306,10 +306,9 @@ module "org" {
 | [iam_bindings_authoritative](variables.tf#L116) | IAM authoritative bindings, in {ROLE => [MEMBERS]} format. Roles and members not explicitly listed will be cleared. Bindings should also be authoritative when using authoritative audit config. Use with caution. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>null</code> |
 | [logging_exclusions](variables.tf#L122) | Logging exclusions for this organization in the form {NAME -> FILTER}. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
 | [logging_sinks](variables.tf#L129) | Logging sinks to create for this organization. | <code title="map&#40;object&#40;&#123;&#10;  destination          &#61; string&#10;  type                 &#61; string&#10;  filter               &#61; string&#10;  include_children     &#61; bool&#10;  bq_partitioned_table &#61; bool&#10;  exclusions &#61; map&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [policy_boolean](variables.tf#L160) | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code>map&#40;bool&#41;</code> |  | <code>&#123;&#125;</code> |
+| [org_policies](variables.tf#L160) | Organization policies applied to this organization keyed by policy name. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; optional&#40;bool&#41; &#35; for list policies only.&#10;  reset               &#61; optional&#40;bool&#41;&#10;  allow &#61; optional&#40;object&#40;&#123;&#10;    all    &#61; optional&#40;bool&#41;&#10;    values &#61; optional&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  deny &#61; optional&#40;object&#40;&#123;&#10;    all    &#61; optional&#40;bool&#41;&#10;    values &#61; optional&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  enforce &#61; optional&#40;bool, true&#41; &#35; for boolean policies only.&#10;  rules &#61; optional&#40;list&#40;object&#40;&#123;&#10;    allow &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    deny &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    enforce &#61; optional&#40;bool, true&#41; &#35; for boolean policies only.&#10;    condition &#61; object&#40;&#123;&#10;      description &#61; optional&#40;string&#41;&#10;      expression  &#61; optional&#40;string&#41;&#10;      location    &#61; optional&#40;string&#41;&#10;      title       &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [policy_list](variables.tf#L167) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; bool&#10;  suggested_value     &#61; string&#10;  status              &#61; bool&#10;  values              &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [tag_bindings](variables.tf#L200) | Tag bindings for this organization, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
-| [tag_bindings](variables.tf#L179) | Tag bindings for this organization, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
+| [tags](variables.tf#L206) | Tags by key name. The `iam` attribute behaves like the similarly named one at module level. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; string&#10;  iam         &#61; map&#40;list&#40;string&#41;&#41;&#10;  values &#61; map&#40;object&#40;&#123;&#10;    description &#61; string&#10;    iam         &#61; map&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>null</code> |
-| [tags](variables.tf#L185) | Tags by key name. The `iam` attribute behaves like the similarly named one at module level. | <code title="map&#40;object&#40;&#123;&#10;  description &#61; string&#10;  iam         &#61; map&#40;list&#40;string&#41;&#41;&#10;  values &#61; map&#40;object&#40;&#123;&#10;    description &#61; string&#10;    iam         &#61; map&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 

modules/organization/organization-policies.tf

@@ -1,4 +1,4 @@
-/**
+s/**
  * Copyright 2022 Google LLC
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
@@ -16,83 +16,98 @@
 
 # tfdoc:file:description Organization-level organization policies.
 
-resource "google_organization_policy" "boolean" {
-  for_each   = var.policy_boolean
-  org_id     = local.organization_id_numeric
-  constraint = each.key
 
-  dynamic "boolean_policy" {
+/**
-    for_each = each.value == null ? [] : [each.value]
+ * Copyright 2022 Google LLC
-    iterator = policy
+ *
-    content {
+ * Licensed under the Apache License, Version 2.0 (the "License");
-      enforced = policy.value
+ * you may not use this file except in compliance with the License.
-    }
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+# tfdoc:file:description Project-level organization policies.
+
+locals {
+  org_policies = {
+    for k, v in var.org_policies :
+    k => merge(v, {
+      is_boolean_policy = v.allow == null && v.deny == null
+      has_values = (
+        length(coalesce(try(v.allow.values, []), [])) > 0 ||
+        length(coalesce(try(v.deny.values, []), [])) > 0
+      )
+      rules = [
+        for r in v.rules :
+        merge(r, {
+          has_values = (
+            length(coalesce(try(r.allow.values, []), [])) > 0 ||
+            length(coalesce(try(r.deny.values, []), [])) > 0
+          )
+        })
+      ]
+    })
   }
+}
 
-  dynamic "restore_policy" {
+resource "google_org_policy_policy" "default" {
-    for_each = each.value == null ? [""] : []
+  for_each = local.org_policies
-    content {
+  name     = "${local.organization_id}/policies/${each.key}"
-      default = true
+  parent   = "${local.organiza}"
-    }
+
-  }
+  spec {
-
+    inherit_from_parent = each.value.inherit_from_parent
-  depends_on = [
+    reset               = each.value.reset
-    google_organization_iam_audit_config.config,
+
-    google_organization_iam_binding.authoritative,
+    rules {
-    google_organization_iam_custom_role.roles,
+      allow_all = try(each.value.allow.all, null) == true ? "TRUE" : null
-    google_organization_iam_member.additive,
+      deny_all  = try(each.value.deny.all, null) == true ? "TRUE" : null
-    google_organization_iam_policy.authoritative,
+      enforce = (
-  ]
+        each.value.is_boolean_policy && each.value.enforce != null
-}
+        ? upper(tostring(each.value.enforce))
-
+        : null
-resource "google_organization_policy" "list" {
+      )
-  for_each   = var.policy_list
+      dynamic "values" {
-  org_id     = local.organization_id_numeric
+        for_each = each.value.has_values ? [1] : []
-  constraint = each.key
+        content {
-
+          allowed_values = try(each.value.allow.values, null)
-  dynamic "list_policy" {
+          denied_values  = try(each.value.deny.values, null)
-    for_each = each.value.status == null ? [] : [each.value]
+        }
-    iterator = policy
+      }
-    content {
+    }
-      inherit_from_parent = policy.value.inherit_from_parent
+
-      suggested_value     = policy.value.suggested_value
+    dynamic "rules" {
-      dynamic "allow" {
+      for_each = each.value.rules
-        for_each = policy.value.status ? [""] : []
+      iterator = rule
-        content {
+      content {
-          values = (
+        allow_all = try(rule.value.allow.all, false) == true ? "TRUE" : null
-            try(length(policy.value.values) > 0, false)
+        deny_all  = try(rule.value.deny.all, false) == true ? "TRUE" : null
-            ? policy.value.values
+        enforce = (
-            : null
+          each.value.is_boolean_policy && rule.value.enforce != null
-          )
+          ? upper(tostring(rule.value.enforce))
-          all = (
+          : null
-            try(length(policy.value.values) > 0, false)
+        )
-            ? null
+        condition {
-            : true
+          description = rule.value.condition.description
-          )
+          expression  = rule.value.condition.expression
-        }
+          location    = rule.value.condition.location
-      }
+          title       = rule.value.condition.title
-      dynamic "deny" {
+        }
-        for_each = policy.value.status ? [] : [""]
+        dynamic "values" {
-        content {
+          for_each = rule.value.has_values ? [1] : [0]
-          values = (
+          content {
-            try(length(policy.value.values) > 0, false)
+            allowed_values = try(rule.value.allow.values, null)
-            ? policy.value.values
+            denied_values  = try(rule.value.deny.values, null)
-            : null
+          }
-          )
+        }
-          all = (
+      }
-            try(length(policy.value.values) > 0, false)
-            ? null
-            : true
-          )
-        }
-      }
-    }
-  }
-
-  dynamic "restore_policy" {
-    for_each = each.value.status == null ? [true] : []
-    content {
-      default = true
     }
   }
 
@@ -103,4 +118,5 @@ resource "google_organization_policy" "list" {
     google_organization_iam_member.additive,
     google_organization_iam_policy.authoritative,
   ]
+
 }

modules/organization/variables.tf

@@ -157,20 +157,41 @@ variable "organization_id" {
   }
 }
 
-variable "policy_boolean" {
+variable "org_policies" {
-  description = "Map of boolean org policies and enforcement value, set value to null for policy restore."
+  description = "Organization policies applied to this organization keyed by policy name."
-  type        = map(bool)
-  default     = {}
-  nullable    = false
-}
-
-variable "policy_list" {
-  description = "Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny."
   type = map(object({
-    inherit_from_parent = bool
+    inherit_from_parent = optional(bool) # for list policies only.
-    suggested_value     = string
+    reset               = optional(bool)
-    status              = bool
+
-    values              = list(string)
+    # default (unconditional) values
+    allow = optional(object({
+      all    = optional(bool)
+      values = optional(list(string))
+    }))
+    deny = optional(object({
+      all    = optional(bool)
+      values = optional(list(string))
+    }))
+    enforce = optional(bool, true) # for boolean policies only.
+
+    # conditional values
+    rules = optional(list(object({
+      allow = optional(object({
+        all    = optional(bool)
+        values = optional(list(string))
+      }))
+      deny = optional(object({
+        all    = optional(bool)
+        values = optional(list(string))
+      }))
+      enforce = optional(bool, true) # for boolean policies only.
+      condition = object({
+        description = optional(string)
+        expression  = optional(string)
+        location    = optional(string)
+        title       = optional(string)
+      })
+    })), [])
   }))
   default  = {}
   nullable = false

modules/project/README.md

@@ -349,7 +349,7 @@ output "compute_robot" {
 | [iam.tf](./iam.tf) | Generic and OSLogin-specific IAM bindings and roles. | <code>google_project_iam_binding</code> · <code>google_project_iam_custom_role</code> · <code>google_project_iam_member</code> |
 | [logging.tf](./logging.tf) | Log sinks and supporting resources. | <code>google_bigquery_dataset_iam_member</code> · <code>google_logging_project_exclusion</code> · <code>google_logging_project_sink</code> · <code>google_project_iam_member</code> · <code>google_pubsub_topic_iam_member</code> · <code>google_storage_bucket_iam_member</code> |
 | [main.tf](./main.tf) | Module-level locals and resources. | <code>google_compute_project_metadata_item</code> · <code>google_essential_contacts_contact</code> · <code>google_monitoring_monitored_project</code> · <code>google_project</code> · <code>google_project_service</code> · <code>google_resource_manager_lien</code> |
-| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_project_organization_policy</code> |
+| [organization-policies.tf](./organization-policies.tf) | Project-level organization policies. | <code>google_org_policy_policy</code> |
 | [outputs.tf](./outputs.tf) | Module outputs. |  |
 | [service-accounts.tf](./service-accounts.tf) | Service identities and supporting resources. | <code>google_kms_crypto_key_iam_member</code> · <code>google_project_default_service_accounts</code> · <code>google_project_iam_member</code> · <code>google_project_service_identity</code> |
 | [shared-vpc.tf](./shared-vpc.tf) | Shared VPC project-level configuration. | <code>google_compute_shared_vpc_host_project</code> · <code>google_compute_shared_vpc_service_project</code> · <code>google_project_iam_member</code> |
@@ -367,8 +367,8 @@ output "compute_robot" {
 | [billing_account](variables.tf#L23) | Billing account id. | <code>string</code> |  | <code>null</code> |
 | [contacts](variables.tf#L29) | List of essential contacts for this resource. Must be in the form EMAIL -> [NOTIFICATION_TYPES]. Valid notification types are ALL, SUSPENSION, SECURITY, TECHNICAL, BILLING, LEGAL, PRODUCT_UPDATES. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [custom_roles](variables.tf#L36) | Map of role name => list of permissions to create in this project. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [default_service_account](variables.tf#L49) | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | <code>string</code> |  | <code>&#34;keep&#34;</code> |
+| [default_service_account](variables.tf#L43) | Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`. | <code>string</code> |  | <code>&#34;keep&#34;</code> |
-| [descriptive_name](variables.tf#L43) | Name of the project name. Used for project name instead of `name` variable. | <code>string</code> |  | <code>null</code> |
+| [descriptive_name](variables.tf#L49) | Name of the project name. Used for project name instead of `name` variable. | <code>string</code> |  | <code>null</code> |
 | [group_iam](variables.tf#L55) | Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [iam](variables.tf#L62) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [iam_additive](variables.tf#L69) | IAM additive bindings in {ROLE => [MEMBERS]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
@@ -378,23 +378,22 @@ output "compute_robot" {
 | [logging_exclusions](variables.tf#L95) | Logging exclusions for this project in the form {NAME -> FILTER}. | <code>map&#40;string&#41;</code> |  | <code>&#123;&#125;</code> |
 | [logging_sinks](variables.tf#L102) | Logging sinks to create for this project. | <code title="map&#40;object&#40;&#123;&#10;  destination   &#61; string&#10;  type          &#61; string&#10;  filter        &#61; string&#10;  iam           &#61; bool&#10;  unique_writer &#61; bool&#10;  exclusions &#61; map&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
 | [metric_scopes](variables.tf#L124) | List of projects that will act as metric scopes for this project. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [oslogin](variables.tf#L136) | Enable OS Login. | <code>bool</code> |  | <code>false</code> |
+| [org_policies](variables.tf#L136) | Organization policies applied to this project keyed by policy name. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; optional&#40;bool&#41; &#35; for list policies only.&#10;  reset               &#61; optional&#40;bool&#41;&#10;  allow &#61; optional&#40;object&#40;&#123;&#10;    all    &#61; optional&#40;bool&#41;&#10;    values &#61; optional&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  deny &#61; optional&#40;object&#40;&#123;&#10;    all    &#61; optional&#40;bool&#41;&#10;    values &#61; optional&#40;list&#40;string&#41;&#41;&#10;  &#125;&#41;&#41;&#10;  enforce &#61; optional&#40;bool, true&#41; &#35; for boolean policies only.&#10;  rules &#61; optional&#40;list&#40;object&#40;&#123;&#10;    allow &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    deny &#61; optional&#40;object&#40;&#123;&#10;      all    &#61; optional&#40;bool&#41;&#10;      values &#61; optional&#40;list&#40;string&#41;&#41;&#10;    &#125;&#41;&#41;&#10;    enforce &#61; optional&#40;bool, true&#41; &#35; for boolean policies only.&#10;    condition &#61; object&#40;&#123;&#10;      description &#61; optional&#40;string&#41;&#10;      expression  &#61; optional&#40;string&#41;&#10;      location    &#61; optional&#40;string&#41;&#10;      title       &#61; optional&#40;string&#41;&#10;    &#125;&#41;&#10;  &#125;&#41;&#41;, &#91;&#93;&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [oslogin_admins](variables.tf#L142) | List of IAM-style identities that will be granted roles necessary for OS Login administrators. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
+| [oslogin](variables.tf#L176) | Enable OS Login. | <code>bool</code> |  | <code>false</code> |
-| [oslogin_users](variables.tf#L150) | List of IAM-style identities that will be granted roles necessary for OS Login users. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
+| [oslogin_admins](variables.tf#L182) | List of IAM-style identities that will be granted roles necessary for OS Login administrators. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [parent](variables.tf#L157) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | <code>string</code> |  | <code>null</code> |
+| [oslogin_users](variables.tf#L190) | List of IAM-style identities that will be granted roles necessary for OS Login users. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [policy_boolean](variables.tf#L167) | Map of boolean org policies and enforcement value, set value to null for policy restore. | <code>map&#40;bool&#41;</code> |  | <code>&#123;&#125;</code> |
+| [parent](variables.tf#L197) | Parent folder or organization in 'folders/folder_id' or 'organizations/org_id' format. | <code>string</code> |  | <code>null</code> |
-| [policy_list](variables.tf#L174) | Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny. | <code title="map&#40;object&#40;&#123;&#10;  inherit_from_parent &#61; bool&#10;  suggested_value     &#61; string&#10;  status              &#61; bool&#10;  values              &#61; list&#40;string&#41;&#10;&#125;&#41;&#41;">map&#40;object&#40;&#123;&#8230;&#125;&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [prefix](variables.tf#L207) | Prefix used to generate project id and name. | <code>string</code> |  | <code>null</code> |
-| [prefix](variables.tf#L186) | Prefix used to generate project id and name. | <code>string</code> |  | <code>null</code> |
+| [project_create](variables.tf#L213) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> |  | <code>true</code> |
-| [project_create](variables.tf#L192) | Create project. When set to false, uses a data source to reference existing project. | <code>bool</code> |  | <code>true</code> |
+| [service_config](variables.tf#L219) | Configure service API activation. | <code title="object&#40;&#123;&#10;  disable_on_destroy         &#61; bool&#10;  disable_dependent_services &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  disable_on_destroy         &#61; false&#10;  disable_dependent_services &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |
-| [service_config](variables.tf#L198) | Configure service API activation. | <code title="object&#40;&#123;&#10;  disable_on_destroy         &#61; bool&#10;  disable_dependent_services &#61; bool&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code title="&#123;&#10;  disable_on_destroy         &#61; false&#10;  disable_dependent_services &#61; false&#10;&#125;">&#123;&#8230;&#125;</code> |
+| [service_encryption_key_ids](variables.tf#L231) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
-| [service_encryption_key_ids](variables.tf#L210) | Cloud KMS encryption key in {SERVICE => [KEY_URL]} format. | <code>map&#40;list&#40;string&#41;&#41;</code> |  | <code>&#123;&#125;</code> |
+| [service_perimeter_bridges](variables.tf#L238) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list&#40;string&#41;</code> |  | <code>null</code> |
-| [service_perimeter_bridges](variables.tf#L217) | Name of VPC-SC Bridge perimeters to add project into. See comment in the variables file for format. | <code>list&#40;string&#41;</code> |  | <code>null</code> |
+| [service_perimeter_standard](variables.tf#L245) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> |  | <code>null</code> |
-| [service_perimeter_standard](variables.tf#L224) | Name of VPC-SC Standard perimeter to add project into. See comment in the variables file for format. | <code>string</code> |  | <code>null</code> |
+| [services](variables.tf#L251) | Service APIs to enable. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
-| [services](variables.tf#L230) | Service APIs to enable. | <code>list&#40;string&#41;</code> |  | <code>&#91;&#93;</code> |
+| [shared_vpc_host_config](variables.tf#L257) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | <code title="object&#40;&#123;&#10;  enabled          &#61; bool&#10;  service_projects &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [shared_vpc_host_config](variables.tf#L236) | Configures this project as a Shared VPC host project (mutually exclusive with shared_vpc_service_project). | <code title="object&#40;&#123;&#10;  enabled          &#61; bool&#10;  service_projects &#61; optional&#40;list&#40;string&#41;, &#91;&#93;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [shared_vpc_service_config](variables.tf#L266) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object&#40;&#123;&#10;  host_project         &#61; string&#10;  service_identity_iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
-| [shared_vpc_service_config](variables.tf#L245) | Configures this project as a Shared VPC service project (mutually exclusive with shared_vpc_host_config). | <code title="object&#40;&#123;&#10;  host_project         &#61; string&#10;  service_identity_iam &#61; optional&#40;map&#40;list&#40;string&#41;&#41;&#41;&#10;&#125;&#41;">object&#40;&#123;&#8230;&#125;&#41;</code> |  | <code>null</code> |
+| [skip_delete](variables.tf#L276) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> |  | <code>false</code> |
-| [skip_delete](variables.tf#L255) | Allows the underlying resources to be destroyed without destroying the project itself. | <code>bool</code> |  | <code>false</code> |
+| [tag_bindings](variables.tf#L282) | Tag bindings for this project, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
-| [tag_bindings](variables.tf#L261) | Tag bindings for this project, in key => tag value id format. | <code>map&#40;string&#41;</code> |  | <code>null</code> |
 
 ## Outputs
 
@@ -402,9 +401,9 @@ output "compute_robot" {
 |---|---|:---:|
 | [custom_roles](outputs.tf#L17) | Ids of the created custom roles. |  |
 | [name](outputs.tf#L25) | Project name. |  |
-| [number](outputs.tf#L38) | Project number. |  |
+| [number](outputs.tf#L37) | Project number. |  |
-| [project_id](outputs.tf#L56) | Project id. |  |
+| [project_id](outputs.tf#L54) | Project id. |  |
-| [service_accounts](outputs.tf#L76) | Product robot service accounts in project. |  |
+| [service_accounts](outputs.tf#L73) | Product robot service accounts in project. |  |
-| [sink_writer_identities](outputs.tf#L92) | Writer identities created for each sink. |  |
+| [sink_writer_identities](outputs.tf#L89) | Writer identities created for each sink. |  |
 
 <!-- END TFDOC -->

modules/project/organization-policies.tf

@@ -16,75 +16,79 @@
 
 # tfdoc:file:description Project-level organization policies.
 
-resource "google_project_organization_policy" "boolean" {
+locals {
-  for_each   = var.policy_boolean
+  org_policies = {
-  project    = local.project.project_id
+    for k, v in var.org_policies :
-  constraint = each.key
+    k => merge(v, {
-
+      is_boolean_policy = v.allow == null && v.deny == null
-  dynamic "boolean_policy" {
+      has_values = (
-    for_each = each.value == null ? [] : [each.value]
+        length(coalesce(try(v.allow.values, []), [])) > 0 ||
-    iterator = policy
+        length(coalesce(try(v.deny.values, []), [])) > 0
-    content {
+      )
-      enforced = policy.value
+      rules = [
-    }
+        for r in v.rules :
-  }
+        merge(r, {
-
+          has_values = (
-  dynamic "restore_policy" {
+            length(coalesce(try(r.allow.values, []), [])) > 0 ||
-    for_each = each.value == null ? [""] : []
+            length(coalesce(try(r.deny.values, []), [])) > 0
-    content {
+          )
-      default = true
+        })
-    }
+      ]
+    })
   }
 }
 
-resource "google_project_organization_policy" "list" {
+resource "google_org_policy_policy" "default" {
-  for_each   = var.policy_list
+  for_each = local.org_policies
-  project    = local.project.project_id
+  name     = "projects/${local.project.project_id}/policies/${each.key}"
-  constraint = each.key
+  parent   = "projects/${local.project.project_id}"
 
-  dynamic "list_policy" {
+  spec {
-    for_each = each.value.status == null ? [] : [each.value]
+    inherit_from_parent = each.value.inherit_from_parent
-    iterator = policy
+    reset               = each.value.reset
-    content {
+
-      inherit_from_parent = policy.value.inherit_from_parent
+    rules {
-      suggested_value     = policy.value.suggested_value
+      allow_all = try(each.value.allow.all, null) == true ? "TRUE" : null
-      dynamic "allow" {
+      deny_all  = try(each.value.deny.all, null) == true ? "TRUE" : null
-        for_each = policy.value.status ? [""] : []
+      enforce = (
+        each.value.is_boolean_policy && each.value.enforce != null
+        ? upper(tostring(each.value.enforce))
+        : null
+      )
+      dynamic "values" {
+        for_each = each.value.has_values ? [1] : []
         content {
-          values = (
+          allowed_values = try(each.value.allow.values, null)
-            try(length(policy.value.values) > 0, false)
+          denied_values  = try(each.value.deny.values, null)
-            ? policy.value.values
-            : null
-          )
-          all = (
-            try(length(policy.value.values) > 0, false)
-            ? null
-            : true
-          )
         }
       }
-      dynamic "deny" {
+    }
-        for_each = policy.value.status ? [] : [""]
+
-        content {
+    dynamic "rules" {
-          values = (
+      for_each = each.value.rules
-            try(length(policy.value.values) > 0, false)
+      iterator = rule
-            ? policy.value.values
+      content {
-            : null
+        allow_all = try(rule.value.allow.all, false) == true ? "TRUE" : null
-          )
+        deny_all  = try(rule.value.deny.all, false) == true ? "TRUE" : null
-          all = (
+        enforce = (
-            try(length(policy.value.values) > 0, false)
+          each.value.is_boolean_policy && rule.value.enforce != null
-            ? null
+          ? upper(tostring(rule.value.enforce))
-            : true
+          : null
-          )
+        )
+        condition {
+          description = rule.value.condition.description
+          expression  = rule.value.condition.expression
+          location    = rule.value.condition.location
+          title       = rule.value.condition.title
+        }
+        dynamic "values" {
+          for_each = rule.value.has_values ? [1] : [0]
+          content {
+            allowed_values = try(rule.value.allow.values, null)
+            denied_values  = try(rule.value.deny.values, null)
+          }
         }
       }
     }
   }
-
-  dynamic "restore_policy" {
-    for_each = each.value.status == null ? [true] : []
-    content {
-      default = true
-    }
-  }
 }

modules/project/outputs.tf

@@ -26,8 +26,7 @@ output "name" {
   description = "Project name."
   value       = local.project.name
   depends_on = [
-    google_project_organization_policy.boolean,
+    google_org_policy_policy.default,
-    google_project_organization_policy.list,
     google_project_service.project_services,
     google_compute_shared_vpc_service_project.service_projects,
     google_project_iam_member.shared_vpc_host_robots,
@@ -39,8 +38,7 @@ output "number" {
   description = "Project number."
   value       = local.project.number
   depends_on = [
-    google_project_organization_policy.boolean,
+    google_org_policy_policy.default,
-    google_project_organization_policy.list,
     google_project_service.project_services,
     google_compute_shared_vpc_host_project.shared_vpc_host,
     google_compute_shared_vpc_service_project.shared_vpc_service,
@@ -59,8 +57,7 @@ output "project_id" {
   depends_on = [
     google_project.project,
     data.google_project.project,
-    google_project_organization_policy.boolean,
+    google_org_policy_policy.default,
-    google_project_organization_policy.list,
     google_project_service.project_services,
     google_compute_shared_vpc_host_project.shared_vpc_host,
     google_compute_shared_vpc_service_project.shared_vpc_service,

modules/project/variables.tf

@@ -40,18 +40,18 @@ variable "custom_roles" {
   nullable    = false
 }
 
-variable "descriptive_name" {
-  description = "Name of the project name. Used for project name instead of `name` variable."
-  type        = string
-  default     = null
-}
-
 variable "default_service_account" {
   description = "Project default service account setting: can be one of `delete`, `deprivilege`, `disable`, or `keep`."
   default     = "keep"
   type        = string
 }
 
+variable "descriptive_name" {
+  description = "Name of the project name. Used for project name instead of `name` variable."
+  type        = string
+  default     = null
+}
+
 variable "group_iam" {
   description = "Authoritative IAM binding for organization groups, in {GROUP_EMAIL => [ROLES]} format. Group emails need to be static. Can be used in combination with the `iam` variable."
   type        = map(list(string))
@@ -133,6 +133,46 @@ variable "name" {
   type        = string
 }
 
+variable "org_policies" {
+  description = "Organization policies applied to this project keyed by policy name."
+  type = map(object({
+    inherit_from_parent = optional(bool) # for list policies only.
+    reset               = optional(bool)
+
+    # default (unconditional) values
+    allow = optional(object({
+      all    = optional(bool)
+      values = optional(list(string))
+    }))
+    deny = optional(object({
+      all    = optional(bool)
+      values = optional(list(string))
+    }))
+    enforce = optional(bool, true) # for boolean policies only.
+
+    # conditional values
+    rules = optional(list(object({
+      allow = optional(object({
+        all    = optional(bool)
+        values = optional(list(string))
+      }))
+      deny = optional(object({
+        all    = optional(bool)
+        values = optional(list(string))
+      }))
+      enforce = optional(bool, true) # for boolean policies only.
+      condition = object({
+        description = optional(string)
+        expression  = optional(string)
+        location    = optional(string)
+        title       = optional(string)
+      })
+    })), [])
+  }))
+  default  = {}
+  nullable = false
+}
+
 variable "oslogin" {
   description = "Enable OS Login."
   type        = bool
@@ -164,25 +204,6 @@ variable "parent" {
   }
 }
 
-variable "policy_boolean" {
-  description = "Map of boolean org policies and enforcement value, set value to null for policy restore."
-  type        = map(bool)
-  default     = {}
-  nullable    = false
-}
-
-variable "policy_list" {
-  description = "Map of list org policies, status is true for allow, false for deny, null for restore. Values can only be used for allow or deny."
-  type = map(object({
-    inherit_from_parent = bool
-    suggested_value     = string
-    status              = bool
-    values              = list(string)
-  }))
-  default  = {}
-  nullable = false
-}
-
 variable "prefix" {
   description = "Prefix used to generate project id and name."
   type        = string