A global media streaming platform is configuring central security guardrails across its Google Cloud resource hierarchy. The security team has defined two mandatory policy enforcement rules: preventing developers from generating service account keys across all projects within the Media-Services folder, and restricting the creation of resources so that compute and storage services can only be deployed in designated European locations (europe-west1 and europe-west3). Which TWO configuration actions should the cloud architect take using Organization Policies to satisfy these guardrails?
- Enforce the boolean constraint constraints/iam.disableServiceAccountKeyCreation on the Media-Services folder.Answer
- Apply the list constraint constraints/gcp.resourceLocations on the target hierarchy node, setting an allowed values list containing in:europe-west1-locations and in:europe-west3-locations.Answer
- CGrant the primitive Owner role to project leads to allow them to self-police regional resource deployment and key creation.
- DConfigure a VPC Service Controls security perimeter around the projects to prevent API requests from executing outside European IP ranges.
Answer
The cloud architect should enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` on the target folder and apply the list constraint `constraints/gcp.resourceLocations` with allowed European location values.
Enforcing `constraints/iam.disableServiceAccountKeyCreation` at the folder level prevents key creation across all nested projects. Applying `constraints/gcp.resourceLocations` with allowed European region values restricts GCP resource deployment strictly to specified geographical regions.
Step-by-Step Solution
Key Concept
Organization Policies supply centralized governance by enforcing boolean and list constraints on resource creation and configuration across the GCP resource hierarchy.