Org Policy Hierarchy Subtree Effective Evaluation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer manages organization policies for an enterprise Google Cloud environment structured with the following resource hierarchy:

Organization (organizations/1001)
- Folder: Engineering (folders/2001)
  - Folder: Development (folders/3001)
    - Project: dev-backend (projects/4001)
  - Project: eng-shared-tools (projects/4002)

The security engineer applies the following organization policy specification at the organization root for a list constraint:

name: organizations/1001/policies/compute.storageResourceUseRestrictions
spec:
  rules:
  - values:
      deniedValues:
      - under:folders/2001

No other organization policies or overrides have been applied at any folder or project level.

What is the effective policy evaluation for dev-backend and eng-shared-tools?

Both dev-backend and eng-shared-tools evaluate to allowed because list constraints ignore inherited deniedValues unless a local merge policy is explicitly configured on each project.

Both dev-backend and eng-shared-tools evaluate to denied because the under: prefix matches the specified folder and recursively encompasses all descendant subfolders and projects in that subtree.

Only eng-shared-tools evaluates to denied because the under: prefix applies exclusively to immediate direct children of folders/2001 and does not cascade through nested subfolders.

Neither project evaluates to denied because subtree values using under: are only valid when the organization policy is attached directly to the target folder (folders/2001).

Professional Cloud Security Engineer

Org Policy Hierarchy Subtree Effective Evaluation

Related questions