IssueTracker

Problem you have encountered:

When I have an organization policy set as follows

• Inheritance- Custom
• ID- constraints/compute.requireVpcFlowLogs
• Effective policy- (Allowed: COMPREHENSIVE)

The following request fails with "Constraint constraints/compute.requireVpcFlowLogs violated for project. To allow the specified configuration for subnetwork test-subnet, the org policy must be disabled. See https://cloud.google.com/vpc/docs/org-policy-flow-logs for more information."

{
	"ipCidrRange": "10.100.100.0/24",
	"logConfig": {
		"aggregationInterval": "INTERVAL_10_MIN",
		"enable": true,
		"filterExpr": "true",
		"flowSampling": 1,
		"metadata": "INCLUDE_ALL_METADATA",
		"metadataFields": []
	},
	"name": "test-subnet",
	"network": "...",
	"region": "..."
}

However, if I remove the "filterExpr": "true" from the request, it works.

What you expected to happen: I would expect it would work as is.

Steps to reproduce: Create the org policy as defined above Send the request as defined above, see the error. Send the same request, remove "filterExpr": "true" and it will succeed.

Other information (workarounds you have tried, documentation consulted, etc): https://github.com/hashicorp/terraform-provider-google/issues/11265