A global media streaming platform is configuring central security guardrails across its Google Cloud resource hierarchy. The security team has defined two mandatory policy enforcement rules: preventing developers from generating service account keys across all projects within the Media-Services folder, and restricting the creation of resources so that compute and storage services can only be deployed in designated European locations (europe-west1 and europe-west3). Which TWO configuration actions should the cloud architect take using Organization Policies to satisfy these guardrails?
- Enforce the boolean constraint constraints/iam.disableServiceAccountKeyCreation on the Media-Services folder.Cevap
- Apply the list constraint constraints/gcp.resourceLocations on the target hierarchy node, setting an allowed values list containing in:europe-west1-locations and in:europe-west3-locations.Cevap
- CGrant the primitive Owner role to project leads to allow them to self-police regional resource deployment and key creation.
- DConfigure a VPC Service Controls security perimeter around the projects to prevent API requests from executing outside European IP ranges.
Cevap
The cloud architect should enforce the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` on the target folder and apply the list constraint `constraints/gcp.resourceLocations` with allowed European location values.
Enforcing `constraints/iam.disableServiceAccountKeyCreation` at the folder level prevents key creation across all nested projects. Applying `constraints/gcp.resourceLocations` with allowed European region values restricts GCP resource deployment strictly to specified geographical regions.
Adım Adım Çözüm
Anahtar Kavram
Organization Policies supply centralized governance by enforcing boolean and list constraints on resource creation and configuration across the GCP resource hierarchy.