An enterprise organization enforces strict data residency rules across its Google Cloud environment. The lead cloud architect applies an Organization Policy list constraint (`constraints/gcp.resourceLocations`) at the Production Folder level, restricting resource creation strictly to `us-central1` and `us-east1`. A project team managing an isolated application inside this Production Folder requires deploying Compute Engine instances in `europe-west1` to satisfy European regulatory requirements. How should the architect configure Google Cloud governance to permit `europe-west1` deployment for this specific project while maintaining the folder-level policy for all other projects?
- Set an Organization Policy override on the specific Project resource node that modifies the allowed values list to include `europe-west1`.Cevap
- BAssign the IAM Owner role to the application project service account so it can bypass Organization Policy constraint evaluation during instance creation.
- CDefine a VPC Service Controls perimeter around the Project and configure an egress rule permitting API requests directed to the `europe-west1` region.
- DGrant the `roles/iam.serviceAccountUser` role to the application deployment team at the project level to bypass resource location constraint validation.
Cevap
Set an Organization Policy override directly at the Project level that updates the allowed locations list to include `europe-west1`.
The correct option correctly leverages Google Cloud's resource hierarchy inheritance rules. Organization Policies inherit down from Organization to Folder to Project. When a specific project requires an exception to a parent folder's list constraint, defining a local policy override on that project node allows specifying custom allowed values (`europe-west1`) for that project while leaving the rest of the folder protected by the original rule.
Adım Adım Çözüm
Anahtar Kavram
Organization Policy Resource Hierarchy Inheritance and Overrides