Examkin

Question

Difficulty: HardConfiguring Organization Policies and Resource Hierarchy Constraints

A security team enforces a strict policy at the root Organization node using the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` set to `enforce: true`. An engineering team managing resources inside a specific child folder named `Legacy-Migration` requires temporary permission to create service account JSON keys for legacy workloads. The security team wants to allow service account key creation exclusively for resources within the `Legacy-Migration` folder hierarchy, while preserving the restriction across all other folders and without modifying user IAM permissions. Which configuration procedure should the security team perform?

  1. Apply an Organization Policy on the `Legacy-Migration` folder node for `constraints/iam.disableServiceAccountKeyCreation`, set `inheritFromParent` to `false`, and set `enforce` to `false`.Answer
  2. B
    Grant the IAM role `roles/iam.serviceAccountKeyAdmin` to the engineering team on the `Legacy-Migration` folder to override the root Organization Policy constraint.
  3. C
    Remove the `iam.serviceAccountKeys.create` permission from the Organization root node IAM policy while granting it on the `Legacy-Migration` folder IAM policy.
  4. D
    Assign the primitive `Owner` role to the engineering team at the `Legacy-Migration` folder level to bypass root-level constraint enforcement.

Answer

Configure an Organization Policy directly on the target folder for the specified boolean constraint, setting enforcement to false and turning off parent policy inheritance.
To override an Organization Policy boolean constraint inherited from a parent node, an administrator must set `enforce` to `false` and set `inheritFromParent` to `false` on the specific child resource node (in this case, the `Legacy-Migration` folder). This exempts resources under that folder without relaxing security rules for the rest of the organization.

Step-by-Step Solution

1
Identify the resource hierarchy target and constraint type.
The target is the `Legacy-Migration` folder, and the constraint is the boolean constraint `constraints/iam.disableServiceAccountKeyCreation`.
Organization Policies evaluate from the top down, with lower nodes inheriting parent policy rules unless explicitly overridden.
2
Determine how to override parent boolean constraint enforcement at a lower hierarchy node.
Setting `enforce: false` and `inheritFromParent: false` at the folder level allows key creation within that folder while keeping the root policy active elsewhere.
Inheritance must be disconnected or explicitly disabled on the child node so the parent's `enforce: true` setting does not take precedence.
3
Validate against IAM relationships.
Organization Policy constraints operate independently of IAM role bindings.
IAM grants capabilities to identities, whereas Organization Policies establish mandatory boundaries on resources.

Key Concept

Organization Policy Hierarchy Inheritance and Boolean Constraint Overrides
Rate this question

Topics

Configuring Organization Policies and Resource Hierarchy Constraints

More questions from this topic