A enterprise governance team is updating security guardrails for a dedicated `Production` folder containing multiple Google Cloud projects. The team must enforce two main requirements: prevent any newly created Compute Engine VMs or Cloud SQL instances from receiving public IP addresses, and evaluate potential pipeline disruptions by auditing policy violations before actively blocking non-compliant resource deployments. Which TWO actions should you recommend to fulfill these requirements? (Select TWO.)
- Apply Organization Policy constraints `compute.vmExternalIpAccess` and `sql.restrictPublicIp` at the `Production` folder level.Answer
- BAssign the primitive `roles/viewer` role to project developers to prevent them from allocating external network interfaces.
- Configure the `dryRunPolicy` specification on the Organization Policy constraints to monitor non-compliant resource requests in Cloud Audit Logs prior to active enforcement.Answer
- DConstruct a VPC Service Controls perimeter around the `Production` folder to block public IP assignment on Compute Engine and Cloud SQL instances.
Answer
Enforce the `compute.vmExternalIpAccess` and `sql.restrictPublicIp` Organization Policy constraints on the target folder, and utilize the `dryRunPolicy` specification to audit policy violations in Cloud Audit Logs without blocking active operations.
Applying boolean Organization Policy constraints (`compute.vmExternalIpAccess` and `sql.restrictPublicIp`) at the target folder level ensures programmatic guardrails against public IP assignment across all underlying projects. Configuring the `dryRunPolicy` specification enables auditing violations via Cloud Logging before enforcing blocking actions, satisfying the mandate to assess impact on CI/CD pipelines.
Step-by-Step Solution
Key Concept
Organization Policy constraints and dry-run evaluation mode