unable to apply json deny policy using gcloud

Question

I am unable to apply deny policy in gcloud.

gcloud beta iam policies create newdenypolicy \
--attachment-point=cloudresourcemanager.googleapis.com/projects/projectid-1 \
--kind=denypolicies \
--policy-file=policy.json`

{
  "displayName": "My deny policy.",
  "rules": [
    {
      "denyRule": {
        "deniedPrincipals": [
          "principal://goog/subject/nnnxxxxx.xyz.com"
        ],
        "deniedPermissions": [
          "compute.googleapis.com"
        ]
      }
    }
  ]
}

I get the error

ERROR: (gcloud.iam.policies.create) Failed to parse YAML from [policy.json]: while scanning for the next token found character '\t' that cannot start any token in "policy.json", line 3, column 1

Answer 1

Looks like a bug.

Evidently (although documented to accept JSON|YAML), the command appears (?.) to expect YAML.

Can you try replacing policy.json with policy.yaml :

displayName: "My deny policy."
rules:
- denyRule:
    deniedPrincipals:
    - principal://goog/subject/nnnxxxxx.xyz.com
    deniedPermissions:
    - compute.googleapis.com

You can report this issue on Google's public Issue Tracker