A enterprise security team wants to restrict the attach capability of cross-project service accounts across all cloud workloads by applying the `constraints/iam.disableCrossProjectServiceAccountUsage` constraint. However, before strictly enforcing this policy, they need to identify existing pipelines and services that rely on cross-project service accounts to prevent operational disruption. Which configuration strategy should the architecture team implement to evaluate potential impact without interrupting active workloads?
- Configure the organization policy constraint in dry-run mode at the organization level, and monitor Cloud Audit Logs for policy violation log entries.Answer
- BAssign the primitive Viewer role to all deployment service accounts across the resource hierarchy to bypass governance constraints during inspection.
- CDefine a VPC Service Controls perimeter around all production projects to restrict unauthorized data movements initiated by service accounts.
- DGrant the Service Account User role to security analysts at the root organization node to override policy violations dynamically.
Answer
Configure the organization policy constraint in dry-run mode at the organization level, and monitor Cloud Audit Logs for policy violation log entries.
Applying Organization Policy constraints in dry-run mode allows organizations to test policy guardrails across the resource hierarchy. In dry-run mode, resource operations that violate the constraint are allowed to proceed, but violation details are emitted to Cloud Audit Logs. This enables security teams to identify non-compliant workloads and update service dependencies before enforcing the policy strictly.
Step-by-Step Solution
Key Concept
Organization Policy Dry-Run Mode and Governance Testing