Examkin

Question

Difficulty: Very hardConfiguring Organization Policies and Resource Hierarchy Constraints

A company manages a Google Cloud resource hierarchy containing an Organization root, a top-level Folder named 'Finance', and a child Project named 'audit-logs-prod'. To enforce data sovereignty compliance, an Organization Policy enforcing the Resource Locations constraint (`constraints/gcp.resourceLocations`) is applied at the 'Finance' Folder level, restricting resource creation strictly to `in:eu-locations`.

A cloud engineer needs to allow the 'audit-logs-prod' project to deploy Cloud Storage buckets in `us-east1` for cross-region disaster recovery testing. The engineer grants the project lead the primitive Owner role (`roles/owner`) on 'audit-logs-prod' and configures the project-level Organization Policy to add `us-east1` to the allowed values list while setting `inheritFromParent: true`. However, bucket creation in `us-east1` continues to fail with an Organization Policy violation error.

What is the root cause of this failure, and how should it be resolved?

  1. The project inherits the parent folder's policy restriction because `inheritFromParent` is set to true; to allow `us-east1`, the project-level Organization Policy must set `inheritFromParent: false` to override the parent list policy and explicitly define the allowed values.Answer
  2. B
    IAM policy inheritance automatically overrides Organization Policies; the project lead must revoke the inherited Viewer role at the 'Finance' folder level so that the project-level Owner role can bypass the resource location constraint.
  3. C
    Organization Policies apply only to service accounts; because the project lead is a human user account, granting the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) directly to the user on the project will grant an exemption from the location constraint.
  4. D
    Primitive roles like Owner are blocked by Organization Policies, but granting the predefined Storage Admin role (`roles/storage.admin`) at the Organization root level will grant the necessary permissions to override Organization Policy constraints.

Answer

The project inherits the parent folder's policy restriction because `inheritFromParent` is set to true; to allow `us-east1`, the project-level Organization Policy must set `inheritFromParent: false` to override the parent list policy and explicitly define the allowed values.
In Google Cloud resource hierarchy policy evaluation, list constraints applied at higher levels (such as a Folder) inherit downward to child projects. When a child project sets `inheritFromParent: true`, it remains bound by the parent's restrictions. To establish a location exception for a specific project under a restricted folder, the child project's Organization Policy must set `inheritFromParent: false` (or explicitly override parent rules) to decouple from the parent folder's list constraint and define its own allowed values list.

Step-by-Step Solution

1
Analyze how list constraint inheritance works in Google Cloud Organization Policies.
When a parent resource node (Folder) enforces a list constraint restricting allowed values (such as restricting locations to `in:eu-locations`), any child node setting `inheritFromParent: true` evaluates the effective policy as the intersection/combination of rules, keeping the parent's restrictions active.
Setting `inheritFromParent: true` on a child policy does not negate or remove restrictions imposed by parent nodes.
2
Evaluate the relationship between IAM roles and Organization Policy constraints.
Granting IAM roles (such as `roles/owner` or `roles/storage.admin`) grants identity permissions but cannot override or bypass an active Organization Policy constraint.
Organization Policies act as guardrails on resources, taking precedence over IAM user permissions.
3
Determine the necessary configuration change to allow the exception.
To allow `us-east1` in the child project `audit-logs-prod`, the project's Organization Policy rule must set `inheritFromParent: false` (restoring/overriding inheritance) and specify the permitted location list directly.
Disabling parent policy inheritance at the project level breaks the restriction inherited from the 'Finance' folder, allowing the project to define its own allowed location rules.

Key Concept

Organization Policy List Constraint Inheritance and Override Mechanisms
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic