A financial enterprise is establishing governance controls across its Google Cloud Organization hierarchy. The security compliance team requires that virtual machines cannot be assigned external public IP addresses and that all new infrastructure resources are restricted to the `us-central1` and `europe-west1` regions. Which TWO Organization Policy constraints should the cloud architect implement to enforce these administrative controls?
- Set the `constraints/compute.vmExternalIpAccess` organization policy constraint to deny external IP address allocation on compute instances.Cevap
- Set the `constraints/gcp.resourceLocations` organization policy constraint to allow resource creation only within `us-central1` and `europe-west1`.Cevap
- CConfigure a VPC Service Controls security perimeter around the projects to prevent external IP assignments and enforce regional resource boundaries.
- DGrant the primitive `roles/owner` role to security administrators at the organization node so they can manually prevent external IP assignment and regional drift.
Cevap
The cloud architect should configure the `constraints/compute.vmExternalIpAccess` constraint to block public IP assignment on VMs and the `constraints/gcp.resourceLocations` constraint to limit resource creation to the specified allowed regions.
The combination of the `constraints/compute.vmExternalIpAccess` constraint (which restricts public IP assignment to compute instances) and the `constraints/gcp.resourceLocations` constraint (which limits resource creation to designated GCP regions) centrally enforces the security and compliance requirements across the organization.
Adım Adım Çözüm
Anahtar Kavram
Organization Policy constraints define centralized programmatic guardrails across the GCP resource hierarchy to enforce security and compliance standards.