A principal attempts to execute an API call on a Compute Engine instance residing in a project nested within a folder hierarchy under an Organization node. IAM Deny policies and IAM Allow policies are configured across multiple levels of the resource hierarchy. In what correct chronological order does Google Cloud IAM evaluate these policies to determine whether to authorize or reject the request?
- 1Evaluate Organization-level IAM Deny policies applicable to the requesting principal and permission.
- 2Evaluate Folder-level IAM Deny policies sequentially down through the parent folder tree.
- 3Evaluate Project-level IAM Deny policies attached to the resource's immediate project container.
- 4Evaluate IAM Allow policies across Organization, Folder, Project, and Resource levels in effective union.
- 5Render final authorization decision: grant access if a matching Allow policy exists, otherwise deny access by default.
Cevap
The correct sequence begins with top-down evaluation of IAM Deny policies starting from the Organization level, followed by intermediate Folder levels, and then the Project level. Next, inherited and direct IAM Allow policies across the entire hierarchy are evaluated in effective union. Finally, the system renders an authorization decision granting access only if a valid Allow policy exists and no Deny policies apply.
In Google Cloud IAM, policy evaluation follows a strict order: Deny policies are evaluated first, starting at the root Organization node and moving down through Folders to the target Project. If no Deny policy matches, IAM computes the union of all inherited and direct Allow policies across Organization, Folder, Project, and Resource levels. If at least one Allow policy grants the permission, access is authorized.
Adım Adım Çözüm
Anahtar Kavram
GCP IAM Policy Evaluation Order and Resource Hierarchy Inheritance