Trying to understand how the Domain restriction Org policy works in GCP. We have an org policy to allow a vendor domain,create a GCP project and given the vendor the Owner role. However the vendor is unable to create any resources like a dataset in BigQuery or a compute engine instance (HTTPError 412: One or more users named in the policy do not belong to a permitted customer.). What additional configurations should we do to allow the vendor to create the resources.
The error you are facing indicates that the vendor’s domain is not permitted to perform actions on your GCP resources due to domain restrictions.
As per this official doc
Some Google Cloud products such as BigQuery, Cloud Run functions,
Cloud Run, Cloud Storage, and Pub/Sub support public data sharing.
Enforcing the domain restricted sharing constraint in an organization
policy will prevent public data sharing.To publicly share data,
disable
the domain restricted sharing constraint temporarily for the Project
resource where the data you want to share resides. After you share the
resource publicly, you can then re-enable the domain restricted
sharing constraint.
See this official doc about Restricting identities by domain