Configure allowed egress fully qualified domain names for data stores

The Restrict egress domains for data connectors managed organization policy constraint lets you specify which fully qualified domain names (FQDNs) are permitted when adding a data store in Gemini Enterprise. The domains you need to add typically include the domain names extracted from the instance URL, authorization URL, and token URL provided when provisioning a data store. For example, if the authorization URL is https://api.cymbal.com/oauth/authorize, you only need to allowlist api.cymbal.com.

Before you begin

  • Ensure you have the Organization Policy Administrator role (roles/orgpolicy.policyAdmin).

  • Understand the policy enforcement dependencies and interactions. See Overview of managed policy constraints.

Configure the constraint

To configure the allowed egress FQDNs, follow these steps:

  1. In the Google Cloud console, go to the Organization Policies page.

    Go to Organization Policies

  2. In the project selector, choose the organization or project where you want to change policy enforcement.

  3. In the Filter field, enter discoveryengine.managed.allowedEgressFqdns or Restrict egress domains for data connectors.

  4. To open the policy details page, click the policy name.

  5. Click Manage Policy.

  6. Select Override parent's policy.

  7. Set Enforcement to On.

  8. Next to the allowedEgressFqdns parameter, click Edit.

  9. Change the Value Type to User-defined.

  10. Click Add item, and then enter each required fully qualified domain name (FQDN). Add only the domain (such as api.cymbal.com), not the full URL. Repeat this step to add all required domains based on your data store type:

    Data store type Required domains
    Custom MCP data stores Add the domain of the MCP server URL, authorization URL, and token URL.
    For example, for an MCP server URL of https://api.cymbal.com/mcp with authorization and token URLs on auth.cymbal.com, add both api.cymbal.com and auth.cymbal.com.
    All other data stores Add the domain of the instance URL, authorization URL, and token URL.
    For example, if your authorization URL is https://auth.cymbal.com/oauth/authorize, add auth.cymbal.com.

  11. Optional. To enforce the managed constraint on projects where VPCSC isn't enabled, click Edit next to the enforcedProjects parameter and add the project numbers.

  12. Click Set Policy.

Verify the policy change

After you apply the new configuration, verify that the policy status is updated.

Verify the policy by attempting to create a data store. If the configuration is correct, you can create the data store without an Operation denied by org policy error related to discoveryengine.managed.allowedEgressFqdns.

What's next