Configure Dry Run Organization Policy

What dryRunSpec and update masks are

The Organization Policy Service supports testing policies prior to live enforcement using the dry-run mode specification (dryRunSpec). A policy defined under dryRunSpec evaluates incoming resource requests against configured list or boolean rules without rejecting non-compliant API calls. When a non-compliant action occurs, an organization policy audit log is emitted to Cloud Logging showing the potential violation. Setting the --update-mask=dryRunSpec flag ensures that only the dry-run configuration is updated on the target resource, preserving the active spec configuration.

How it meets the requirements

• Non-disruptive testing: Placing the rules under dryRunSpec ensures that API calls violating the new service restrictions are permitted rather than blocked.
• Audit logging generation: Violations against dryRunSpec are captured directly in audit logs, allowing administrators to quantify impact.
• Preserves existing live policy: Supplying --update-mask=dryRunSpec instructs gcloud to update exclusively the dry-run specification without overwriting, modifying, or clearing the currently enforced live rules in the spec field.

Key advantages and capabilities

• Safe policy rollout lifecycle: Enables teams to stage policy changes from audit to live enforcement seamlessly.
• Targeted field updates: Using update masks prevents accidental destruction of existing spec rules.
• Unified configuration model: Allows both spec (enforced live) and dryRunSpec (simulated) to coexist on the same resource.
• Hierarchical visibility: Descendant folders and projects inherit the dryRunSpec rules unless explicitly overridden.

Why this is optimal

This approach leverages the native Organization Policy Service v2 architecture. Alternative methods that place test rules in the live spec field risk service outages or disable enforcement entirely.