Examkin

Soru

Zorluk: OrtaOrganization Policies and Constraints

An enterprise architecture team needs to prevent developers across all Google Cloud projects from granting IAM permissions to external Google accounts outside the corporate Cloud Identity directory. This governance control must apply automatically across all existing and newly created folders and projects within the organization. Which architectural approach should the team implement to meet this requirement?

  1. Define an Organization Policy at the organization root node enforcing the Domain Restricted Sharing constraint (constraints/iam.allowedPolicyMemberDomains) with your Cloud Identity customer ID.Cevap
  2. B
    Assign the primitive Owner IAM role to security administrators at the top-level folder so they can audit and manually remove external policy bindings.
  3. C
    Construct a VPC Service Controls perimeter encompassing all projects to prevent external identities from accessing resource APIs.
  4. D
    Grant developers the Service Account User role across the resource hierarchy so they can delegate identity management exclusively through service accounts.

Cevap

Enforce an Organization Policy at the organization root using the Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) configured with the enterprise Cloud Identity customer ID.
The Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) enforced at the Organization node establishes a strict boundary for IAM member additions. By specifying the corporate Cloud Identity customer ID, Google Cloud prevents any user from binding IAM roles to accounts outside the specified identity domain across all existing and future projects.

Adım Adım Çözüm

1
Identify the governance requirement.
The requirement is to restrict IAM membership across all current and future projects to allowed identity domains.
Central security governance requires declarative guardrails enforced via the resource hierarchy.
2
Evaluate Google Cloud Organization Policy constraints.
The constraint `constraints/iam.allowedPolicyMemberDomains` limits the set of identities allowed in IAM policy bindings to specified Cloud Identity customer IDs.
Organization policies inherit down the resource hierarchy (Organization → Folders → Projects), ensuring automatic coverage for all projects.

Anahtar Kavram

Organization Policies - Domain Restricted Sharing
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Organization Policies and Constraints

Bu konudan daha fazla soru