Examkin

Question

Difficulty: HardConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise Google Cloud environment enforces the boolean Organization Policy constraint `constraints/compute.disableGlobalSerialPortAccess` (Enforced: True) at the root Organization node. A DevOps engineer who holds the primitive `roles/owner` IAM role on a child project within a subfolder attempts to enable interactive serial console access on a Compute Engine instance in that project using the Google Cloud CLI. Which statement correctly describes the outcome of this operational request and the underlying policy enforcement mechanism?

  1. The operational request will fail because Organization Policies establish programmatically enforced guardrails across the resource hierarchy that cannot be overridden by IAM permissions; enabling access requires an explicit policy override or exception configured by an Organization Policy Administrator at the folder or project level.Answer
  2. B
    The operational request will succeed because the primitive Project Owner role (`roles/owner`) grants full administrative control over project resources, which inherently takes precedence over inherited Organization Policy restrictions.
  3. C
    The operational request will fail, but the engineer can resolve the issue by attaching an explicit IAM allow policy directly to the instance granting the `compute.instances.setMetadata` permission to bypass the root policy.
  4. D
    The operational request will fail because primitive roles lack Organization Policy management capabilities; the engineer must be assigned the `roles/resourcemanager.organizationPolicyAdmin` IAM role on the project to automatically bypass the constraint.

Answer

The operational request will fail because Organization Policies establish programmatically enforced guardrails across the resource hierarchy that cannot be overridden by IAM permissions; enabling access requires an explicit policy override or exception configured by an Organization Policy Administrator at the folder or project level.
Google Cloud Organization Policies set constraints on specific Google Cloud service resources to configure guardrails across an entire organization. These constraints evaluate independently of IAM roles and permissions. Even users with primitive Owner (`roles/owner`) privileges cannot perform operations that violate active Organization Policy constraints. To allow the operation, an authorized user with the `roles/resourcemanager.organizationPolicyAdmin` role must explicitly alter or override the policy constraint at the appropriate folder or project level in the resource hierarchy.

Step-by-Step Solution

1
Analyze the relationship between IAM permissions and Organization Policies.
IAM determines identity access authorization ('who can do what'), while Organization Policies define resource configuration restrictions ('what can be done to resources').
Understanding the separation of concerns between IAM and Organization Policies is essential.
2
Evaluate the effect of resource hierarchy inheritance for Organization Policy constraints.
The boolean constraint `constraints/compute.disableGlobalSerialPortAccess` set at the root Organization node is inherited down to folders and projects unless explicitly overridden by an authorized role.
Organization Policies follow the Google Cloud resource hierarchy inheritance model.
3
Determine if primitive Project Owner (`roles/owner`) privileges can bypass Organization Policy enforcement.
IAM roles, including primitive Owner/Editor roles, cannot bypass enforced Organization Policy constraints.
Organization Policies sit above IAM in restricting allowed resource configurations.

Key Concept

Organization Policies vs IAM Roles & Hierarchy Inheritance
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic