Organization Policy Service
1. Organization Policy Service
A person famously coined the phrase, “A stitch in time, saves nine.” The meaning of this phrase is when you deal with a situation right away, it saves you time later. This is true in cloud security as much as in life. In this video, we’ll explore Organization Policy Service, Google Cloud’s tool for managing organization policies. As a cloud security professional, Organization Policy Service gives you centralized control over organization policies throughout your resource hierarchy. And it lets you choose resource configurations to allow and enforce in your cloud environment. When organizational policies are well defined, teams can work with confidence, knowing they’re in compliance with laws, best practices, and the organization’s information security policy. Organizational policies apply to newly created organization, project, and folder resource hierarchy nodes. So, resources automatically contribute to your organization’s scalability. Whether you create a few dozen or a few thousand new resources, they’ll all follow the organizational policies in place. You can get all the permissions needed to set constraints using Organization Policy Service by asking your administrator to grant you the Organization Policy Administrator role. You may also be able to achieve the permissions you need using custom roles. Once you have the required permissions, you’ll be able to create, modify, and delete constraints. A constraint is a restriction against a Google Cloud service, or a list of services. You can think of a constraint as a blueprint that defines what behaviors are controlled. Once you apply a constraint to an organization, folder, or project, the Google Cloud service mapped to the constraint will enforce the restrictions you’ve configured. Let’s explore some constraints you can configure using Organization Policy Service. The domain-restricted sharing constraint limits the set of identities that can be used in identity and access management, or IAM Policies. You can use this constraint to limit resource sharing to a specific Google domain or set of domains. Several constraints can be used to limit the use of IAM service accounts in your cloud environment. You can use the disable automatic role grants to default service accounts constraint to keep default service accounts from automatically receiving the editor role. Other constraints that can help keep service accounts secure include disable service account, or SA, key creation, disable SA key upload, or limit lifetime of service account keys. Making sure your organization policies surrounding service accounts are configured properly helps your organization follow the principle of least privilege by making sure accounts have only the access they need. You can use the restrict resource locations constraint to set a list of physical locations where you will create new resources. Permitted resource locations can include multi-regions and zones. Multi-region locations examples are the USA and Europe, because they have more than one region, like specific cities or states. Regions contain zones, which are independent failure domains. For example, you may work at an organization that falls under data residency requirements. You can use a list constraint to specify the set of locations where cloud resources can be created, and data can be stored. If someone in your organization attempts to create a resource in a location that isn’t on the list, they’ll get an error, the resource will not be created, and the attempt will be logged. You can use Organization Policy Service to view all enforced policies, and to edit policies after creating them. It’s a good idea to review and evaluate your organization policies regularly, and update them if needed, so they align with your organization’s goals and structure. Organization Policy Service helps your organization address potential cloud security problems before they occur. Remember, putting the effort in now can help save you time later and keep your data secure. Who doesn’t want that?2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.