If a project has or inherits a Domain Restricted Sharing org policy, It appears this prevents adding the cloudfunction invoker role to allUsers or allAuthenticatedUsers?

If it’s possible to add allUsers to the policy as an allowed domain, what would be the syntax for doing that?

Or is it necessary to override the policy for that project and allow any domain?

resource "google_cloudfunctions_function_iam_member" "cloud_function_invoker_before_create" {
  project        = <PROJ_ID>
  region         = <REGION>
  cloud_function = name
  role           = "roles/cloudfunctions.invoker"
  member         = "allUsers"
}

Results in error

Error applying IAM policy for cloudfunctions cloudfunction "projects/<PROJ_ID>/locations/<REGION>/functions/firebaseAuthBeforeCreate": Error setting IAM policy for cloudfunctions cloudfunction googleapi: Error 400: One or more users named in the policy do not belong to a permitted customer.

"violations": [
       {
         "description": "User allUsers is not in permitted organization.",
         "subject": "orgpolicy:,<PROJECT_ID>/<REGION>/firebaseAuthBeforeCreate?configvalue=allUsers",
         "type": "constraints/iam.allowedPolicyMemberDomains"
       }