A enterprise security team is implementing governance guardrails across a multitenant Google Cloud environment. They plan to restrict the activation of unauthorized service APIs using the `constraints/gcp.restrictServiceUsage` Organization Policy. However, to avoid disrupting existing workloads currently undergoing active development, the team wants to monitor potential violations in real time and evaluate the impact of the policy without blocking resource creation. Which configuration approach meets these requirements?
- Configure the Organization Policy constraint using a dry-run policy specification at the target resource hierarchy node.Answer
- BAssign the Owner or Editor primitive IAM roles to the deployment pipeline service accounts so they can override resource restrictions.
- CDefine a VPC Service Controls perimeter around the development folders to log unauthorized API invocations to external Cloud Storage buckets.
- DGrant the Service Account User role to developers across the organization root to allow bypassing API enforcement constraints.
Answer
Configure the Organization Policy constraint using a dry-run policy specification at the target resource hierarchy node.
Configuring a dry-run policy specification allows administrators to simulate and log compliance violations without blocking deployment operations. Non-compliant API activations generate audit logs, giving visibility into compliance readiness before enforcing the constraint strictly.
Step-by-Step Solution
Key Concept
Organization Policy Dry-Run Mode and Audit Logging