A security audit team for a digital healthcare provider needs to enforce strict network perimeter controls across all Compute Engine virtual machines residing in a specific folder named 'Data Processing'. They want to ensure no instances in this folder receive external IP addresses and that policy administrative duties follow the principle of least privilege. Which TWO actions should the team take to meet these governance requirements? (Select TWO.)
- Set the `constraints/compute.vmExternalIpAccess` list constraint on the 'Data Processing' folder to deny external IP address allocation for child VM instances.Answer
- Grant the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) to the security auditors so they can configure hierarchy constraints without full administrative ownership.Answer
- CGrant the primitive Owner role (`roles/owner`) on the folder to the security auditors to allow management of resource constraints across child projects.
- DConfigure IAM policy bindings on child projects to grant access rights that override and bypass the folder's policy restrictions for trusted service accounts.
Answer
The correct actions are enforcing the `constraints/compute.vmExternalIpAccess` list constraint on the folder level and assigning the Organization Policy Admin (`roles/orgpolicy.policyAdmin`) role to the security auditors.
To restrict external IP configuration on VMs within a folder while following least privilege, administrators must apply the `constraints/compute.vmExternalIpAccess` list constraint directly to the target folder and grant administrators the specialized Organization Policy Admin role (`roles/orgpolicy.policyAdmin`).
Step-by-Step Solution
Key Concept
Configuring Organization Policies and Resource Hierarchy Constraints with Least Privilege IAM Roles