Examkin

Question

Difficulty: Very hardConfiguring Organization Policies and Resource Hierarchy Constraints

An enterprise manages its Google Cloud infrastructure using a multi-layer resource hierarchy. At the organization root level, an Organization Policy enforces the Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) with an allowed list containing Primary Domain Customer ID `C01111111`.

To allow integration with a partner company, a cloud administrator updates the policy for `constraints/iam.allowedPolicyMemberDomains` on the `Partner-Projects` folder by setting `inheritFromParent: true` and adding Customer ID `C02222222` to the allowed list.

A project administrator for `Project-X` (located inside the `Partner-Projects` folder) attempts to perform two separate IAM policy updates on `Project-X`:
1. Granting `roles/storage.admin` to an identity belonging to Customer ID `C01111111`.
2. Granting `roles/storage.admin` to an identity belonging to Customer ID `C03333333`.

Which outcome will occur when the project administrator attempts these IAM role assignments?

  1. The grant for Customer ID C01111111 succeeds because setting inheritFromParent to true merges allowed values from the organization and folder levels, while the grant for Customer ID C03333333 is blocked by the effective organization policy constraint.Answer
  2. B
    Both grants fail because defining an Organization Policy constraint at the folder level overrides and completely replaces all allowed domain configurations set at the organization root.
  3. C
    Both grants succeed because project administrators holding administrative permissions on a project can override Organization Policy guardrails when granting IAM roles.
  4. D
    The grant for Customer ID C03333333 succeeds if assigned using Primitive roles like Owner or Editor, but fails if assigned using Predefined IAM roles.

Answer

The grant for Customer ID C01111111 succeeds because setting inheritFromParent to true merges allowed values from the organization and folder levels, while the grant for Customer ID C03333333 is blocked by the effective organization policy constraint.
For Organization Policy list constraints, setting `inheritFromParent: true` creates an effective policy that combines (merges) the allowed values from parent nodes with those defined at the local node. Therefore, both Customer ID C01111111 and Customer ID C02222222 are permitted members for IAM bindings in child projects. The attempt to add an identity from Customer ID C03333333 fails because it is not on the effective allowed list, and Organization Policies strictly restrict IAM operations regardless of user role privilege level.

Step-by-Step Solution

1
Evaluate Organization Policy list constraint inheritance behavior at the folder level.
Because `inheritFromParent: true` is explicitly configured on the `Partner-Projects` folder for `constraints/iam.allowedPolicyMemberDomains`, the effective policy at the folder (and child projects) is the union of the parent allowed list (`C01111111`) and the folder allowed list (`C02222222`).
List constraints with inheritance enabled merge allowed values down the resource hierarchy.
2
Evaluate the first IAM grant attempt for Customer ID C01111111 on Project-X.
The operation succeeds.
Customer ID C01111111 is present in the effective allowed domain list inherited from the organization root.
3
Evaluate the second IAM grant attempt for Customer ID C03333333 on Project-X.
The operation is denied by the resource manager enforcement check.
Customer ID C03333333 is not included in either the organization root policy or the folder policy, and IAM permissions cannot bypass Organization Policy constraints.

Key Concept

Organization Policy List Constraint Inheritance and IAM Guardrail Enforcement
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic