# 示例：传统约束。先检查有效策略和 managed 约束，填写后才可用于实验。
name: projects/REPLACE_PROJECT_NUMBER/policies/iam.disableServiceAccountKeyCreation
spec:
  rules:
  - enforce: true