remove exactly one policy from organization policies, as we can have …

…none if they inherit from parent

third_party/terraform/resources/resource_google_organization_policy.go

@@ -10,17 +10,20 @@ import (
 )
 
 var schemaOrganizationPolicy = map[string]*schema.Schema{
+	// Although the API suggests that boolean_policy, list_policy, or restore_policy must be set,
+	// Organization policies can be "inherited from parent" in the UI, and this is the default
+	// state of the resource without any policy set.
+	// See https://github.com/terraform-providers/terraform-provider-google/issues/3607
 	"constraint": {
 		Type:             schema.TypeString,
 		Required:         true,
 		ForceNew:         true,
 		DiffSuppressFunc: compareSelfLinkOrResourceName,
 	},
 	"boolean_policy": {
-		Type:         schema.TypeList,
-		Optional:     true,
-		MaxItems:     1,
-		ExactlyOneOf: []string{"list_policy", "boolean_policy", "restore_policy"},
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"enforced": {
@@ -31,10 +34,9 @@ var schemaOrganizationPolicy = map[string]*schema.Schema{
 		},
 	},
 	"list_policy": {
-		Type:         schema.TypeList,
-		Optional:     true,
-		MaxItems:     1,
-		ExactlyOneOf: []string{"list_policy", "boolean_policy", "restore_policy"},
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"allow": {
@@ -109,10 +111,9 @@ var schemaOrganizationPolicy = map[string]*schema.Schema{
 		Computed: true,
 	},
 	"restore_policy": {
-		Type:         schema.TypeList,
-		Optional:     true,
-		MaxItems:     1,
-		ExactlyOneOf: []string{"restore_policy", "boolean_policy", "list_policy"},
+		Type:     schema.TypeList,
+		Optional: true,
+		MaxItems: 1,
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"default": {

third_party/terraform/website/docs/guides/version_3_upgrade.html.markdown

@@ -1358,11 +1358,6 @@ required on the `http_check.auth_info` block.
 
 ## Resource: `google_organization_policy`
 
-### Exactly one of `list_policy`, `boolean_policy`, or `restore_policy` is now required on `google_organization_policy`
-
-In attempt to be more consistent with the API, exactly one of `list_policy`, `boolean_policy`,
-or `restore_policy` is now required on `google_organization_policy`.
-
 ### Exactly one of `allow` or `deny` is now required on `google_organization_policy.list_policy`
 
 In an attempt to avoid allowing empty blocks in config files, exactly one of `allow` or `deny` is now