IssueTracker

What you would like to accomplish:

Currently, the Organization Policy constraints/iam.allowedPolicyMemberDomains accepts a list of Google Workspace customer IDs as allowed values. This makes the primary and all secondary domains tied to the Workspace to be allowed policy members within the organization. I would like to only allow one (the primary) domain to be allowed for IAM policies.

How this might work:

Accept a list of allowed domains (similar to constraints/essentialcontacts.allowedContactDomains) instead of a list of allowed customer IDs. Or some way to filter specific domains within a Workspace (e.g., via conditions).

If applicable, reasons why alternative solutions are not sufficient:

With the current approach, we have about 100 secondary domains attached to our org which we don't want to allow IAM bindings on. The suggestion from the documentation to separate domains with different Google Workspace accounts is not feasible:

To differentiate domain restriction constraint access between two domains, each domain must be associated with a different Google Workspace account. Each Google Workspace account is associated with an organization node, and can have their own organization policies applied. This allows you to associate domain.com with one Google Workspace account, and sub.domain.com with another for more granular access control.

Other information (workarounds you have tried, documentation consulted, etc):

I thought this might be something I could solve for using conditions (resource.matchTag(...)) but I don't think it is currently possible this way.