An enterprise software team manages multiple environment folders under their Google Cloud organization. In the Staging folder, service account JSON key creation is currently permitted to support legacy integration tests. However, for a newly created high-security project named finance-vault-prod residing inside the Staging folder, security compliance mandates that service account key creation must be blocked completely. Which action should a Cloud Engineer take to enforce this security restriction on finance-vault-prod without modifying the policy settings for other projects in the Staging folder?
- Apply the Organization Policy boolean constraint constraints/iam.disableServiceAccountKeyCreation with enforcement set to Enforce directly at the finance-vault-prod project level.Cevap
- BRemove the serviceaccountadmin role at the Staging folder level to prevent users from creating service account keys across all nested projects.
- CEnable the constraints/iam.disableServiceAccountKeyCreation constraint at the Staging folder level and expect child projects to automatically ignore it unless explicitly re-enabled.
- DGrant the primitive Viewer role to all project users on finance-vault-prod to restrict service account key generation capabilities.
Cevap
Apply the Organization Policy boolean constraint constraints/iam.disableServiceAccountKeyCreation with enforcement set to Enforce directly at the finance-vault-prod project level.
In the Google Cloud resource hierarchy, Organization Policies are inherited from top to bottom (Organization → Folder → Project). Applying a constraint directly at the project level allows an administrator to set a specific enforcement rule that applies exclusively to that project, overriding any looser policy settings inherited from its parent folder.
Adım Adım Çözüm
Anahtar Kavram
Organization Policy inheritance and node-level constraint overrides