Enterprise constraints

This page describes how to configure and manage enterprise constraints in HashiCorp Cloud Platform (HCP). Enterprise constraints allow you to restrict which HCP products your organization can deploy, providing centralized governance and cost control.

Introduction

An enterprise constraint is a preventative control that restricts which HCP products your organization may deploy. Enterprise constraints work alongside Role-Based Access Control (RBAC) to provide an additional layer of governance. While RBAC determines who can perform actions, enterprise constraints determine what types of resources your organization may create, regardless of individual user permissions.

Enterprise constraints apply at the organization level and automatically cascade to all projects within the organization. When you enable a constraint for a product, users cannot create new resources for that product, even if their role would otherwise allow it. Existing resources continue to operate normally when you enable a constraint.

Enterprise constraints help you:

Control flexible consumption spending - Prevent budget overruns by limiting which products teams can deploy
Meet security compliance requirements - Disable products that have not passed internal security reviews
Enforce organizational standards - Maintain clear separation of duties across teams

You can restrict the following HCP products:

HCP Vault
HCP Boundary
HCP Vault Radar
HCP Packer
HCP Waypoint
HCP Vagrant

Note: HCP Terraform is not affected by enterprise constraints.

Considerations

Organization-level only: Constraints can only be applied at the organization level. You cannot create project-specific overrides or exceptions.
Product-level restrictions: Constraints currently restrict entire products. You cannot restrict specific features.

Prerequisites

To configure enterprise constraints, you must have one of the following roles:

Organization Owner
Organization Admin

You should also understand which HCP products your teams currently use or plan to use.

Enable enterprise constraints

To enable enterprise constraints:

At the top, click the dropdown to open the organization and project selector. Select View all organizations.
Click the name of the organization.
From the Organization dashboard, click Organization settings.
Click Enterprise constraints in the left navigation.
Select the products you want to restrict from the available list:
- HCP Vault
- HCP Boundary
- HCP Vault Radar
- HCP Packer
- HCP Waypoint
- HCP Vagrant
Click Save constraints.

After saving, the constraints take effect immediately. Users attempting to create resources for restricted products see an error message indicating that the product is not available in the organization.

View active constraints

To view which constraints are currently active:

At the top, click the dropdown to open the organization and project selector. Select View all organizations.
Click the name of the organization.
From the Organization dashboard, click Organization settings.
Click Enterprise constraints in the left navigation.

The page displays all products and indicates which ones are currently restricted.

Modify constraints

To modify enterprise constraints:

Navigate to the Enterprise constraints page following the steps in the View active constraints section.
Select or deselect products to change which ones are restricted.
Click Save constraints.

Changes take effect immediately. If you remove a constraint, users can immediately begin creating resources for that product again.

Important behaviors

Enterprise constraints have the following behaviors:

Existing resources are not affected: When you enable a constraint for a product, any existing resources for that product continue to operate normally. The constraint only prevents creation of new resources.
All projects inherit constraints: Organization-level constraints apply to all projects within the organization. You cannot override a constraint for a specific project.
Clear error messages when applicable: If a user attempts to create a resource through API or other paths where UI controls are not hidden, they receive an error message indicating that the product is not available in the organization.
UI adapts to constraints: When a product is restricted, create actions or settings for that product are hidden or disabled in the HCP UI. For example, “Create” buttons and related entry points may not appear. In some cases, users may not encounter an error because the option to create the resource is not presented.
Audit logging: All changes to enterprise constraints are recorded in audit logs, including who made the change and when.

Audit and monitoring

All changes to enterprise constraints are recorded in HCP audit logs. Each audit log entry includes:

The principal (user or service principal) who made the change
The organization ID
The constraint that was enabled or disabled
The timestamp of the change

To access audit logs, refer to the HCP audit log documentation.