A cloud security team is establishing centralized governance guardrails for a newly created Google Cloud folder named Staging. The organization's security policy demands two specific restrictions across all projects within this folder: preventing Compute Engine instances from being assigned external IP addresses, and blocking the creation of external service account keys. Which TWO Organization Policy constraints should be enforced on the Staging folder to meet these security requirements? (Select TWO)
- Enforce the constraints/compute.vmExternalIpAccess constraint to restrict external IP assignment on virtual machine instances.Cevap
- Enforce the constraints/iam.disableServiceAccountKeyCreation boolean constraint to prevent the creation of service account keys.Cevap
- CGrant developers the Service Account User (roles/iam.serviceAccountUser) role at the folder level to block key generation capabilities.
- DConfigure a VPC Service Controls perimeter around the folder to block external IP allocation and service account key creation.
- EAssign the primitive Viewer (roles/viewer) role to project owners to disable their administrative rights for creating keys and external IPs.
Cevap
Enforce the constraints/compute.vmExternalIpAccess constraint to restrict external IP addresses on VM instances, and enforce the constraints/iam.disableServiceAccountKeyCreation boolean constraint to prevent service account key creation.
The correct guardrails are established using Organization Policy constraints. The constraint controlling external IP assignment on virtual machines is constraints/compute.vmExternalIpAccess, while the boolean constraint that prevents users from generating service account keys is constraints/iam.disableServiceAccountKeyCreation. Applying both at the folder level enforces these guardrails on all existing and future child projects.
Adım Adım Çözüm
Anahtar Kavram
Google Cloud Organization Policy constraints for resource restriction and identity guardrails