Examkin

Question

Difficulty: HardOrganization Policies and Constraints

A biotechnology enterprise manages its Google Cloud infrastructure using a resource hierarchy where all production applications reside inside a folder named 'Production-Workloads'. The security governance board mandates that service account key creation must be blocked across all projects within this folder to reduce exposure to credential leaks. However, a legacy data ingestion project inside 'Production-Workloads' relies on service account keys and cannot be immediately refactored until a Workload Identity Federation migration completes. Which approach should the cloud architect implement to enforce this governance requirement with minimal operational complexity?

  1. A
    Grant primitive Owner roles at the 'Production-Workloads' folder level and configure IAM Deny rules on the legacy project to restrict service account key management capabilities.
  2. B
    Establish a VPC Service Controls perimeter around the 'Production-Workloads' folder and create an egress rule excluding the legacy data ingestion project from perimeter restrictions.
  3. Apply the Organization Policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the 'Production-Workloads' folder level, and set an explicit policy override enforcing 'Off' at the legacy project level.Answer
  4. D
    Assign the Service Account User role to developers at the folder level and revoke the Service Account Admin role from all service account identities within the legacy project.

Answer

Apply the Organization Policy constraint 'constraints/iam.disableServiceAccountKeyCreation' at the 'Production-Workloads' folder level, and set an explicit policy override enforcing 'Off' at the legacy project level.
The correct approach leverages Google Cloud Organization Policies. Applying the boolean constraint 'constraints/iam.disableServiceAccountKeyCreation' at the 'Production-Workloads' folder level enforces key creation restrictions for all current and future child projects. Configuring an explicit project-level policy override with enforcement turned off allows the legacy project to remain exempted without compromising governance across the rest of the folder.

Step-by-Step Solution

1
Analyze the governance constraint requirements across the resource hierarchy.
Identified the need to restrict service account key creation across all projects in a specific folder while granting an exception to a single child project.
Organization Policies are designed to enforce central constraints on Google Cloud resources across the organization, folder, or project hierarchy.
2
Evaluate the inheritance mechanism of Google Cloud Organization Policies.
Determined that policies applied at a parent folder propagate to child projects unless an explicit policy override is configured at the project level.
Setting 'constraints/iam.disableServiceAccountKeyCreation' to Enforced at the folder level blocks key creation for all child projects by default.
3
Configure the project-level exception for the legacy workload.
Overriding the organization policy constraint on the legacy project setting enforcement to 'Off' restores key creation for that specific project only.
Explicit project-level organization policy configurations override inherited folder-level rules, fulfilling the temporary exception requirement with minimal effort.

Key Concept

Organization Policy Resource Hierarchy Inheritance and Localized Overrides
Estimated Time:2m 0s
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic