A cloud administrator manages a Google Cloud resource hierarchy consisting of an Organization root, a 'Finance' folder, and several child projects. An Organization Policy set at the Organization root uses the list constraint `constraints/gcp.resourceLocations` with allowed values configured to `in:us-locations`. To satisfy local compliance mandates, all newly provisioned GCP resources within projects under the 'Finance' folder must be strictly restricted to the `asia-east1` region, overriding the inherited Organization Policy. Which action should the administrator take to achieve this governance requirement?
- Apply an Organization Policy on the 'Finance' folder for `constraints/gcp.resourceLocations`, set the rules to replace parent policies, and add `asia-east1` as the allowed location value.Cevap
- BGrant the IAM role `roles/orgpolicy.policyAdmin` to the Finance project service account and delete the `in:us-locations` IAM policy binding on the 'Finance' folder.
- CCreate a custom IAM role at the 'Finance' folder level that denies resource creation in regions outside `asia-east1` to override parent folder permissions.
- DAssign the primitive Owner role (`roles/owner`) to administrators on the 'Finance' folder to bypass and reset inherited Organization Policy constraints.
Cevap
Apply an Organization Policy on the 'Finance' folder for `constraints/gcp.resourceLocations`, set the rules to replace parent policies, and add `asia-east1` as the allowed location value.
Organization Policies allow administrators to enforce constraints across the resource hierarchy. For list constraints like `constraints/gcp.resourceLocations`, setting a policy at a child folder level with the rule to replace parent policy values ensures that inherited constraints are overridden and only the newly defined allowed location (`asia-east1`) is enforced.
Adım Adım Çözüm
Anahtar Kavram
Organization Policy List Constraint Hierarchy Inheritance & Override Rules
Tahmini Süre:1m 30s