Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
Organization Policy Service
Topic in 6 exam domains
Also called: Google Cloud Organization Policies, Google Cloud Organization Policy, Google Cloud Organization Policy Service, org policy service, organization policies, Organization Policy, Organization Policy Service v2, OrgPolicy
A Google Cloud service providing centralized, programmatic control over organization resources through policy constraints.
Where this appears on the exam
6 objectives in 3 of 5 domains
~22% of exam
~15% of exam
~18% of exam
Related topics
FoundationsThis topicBuilds on theseAppliedIdentity and Access ManagementServiceCloud LoggingServiceVPC Service ControlsServiceResource ManagerServiceDataformServiceWorkflowsServiceCloud StorageServiceCloud MonitoringService
Organization Policy ServiceService
BigQueryServiceCompute EngineServicecustom constraintsFeaturedomain restricted sharingFeatureresource locations constraintFeatureRestrict TLS VersionsFeatureGKEServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- custom constraints is part of Organization Policy Service From the official documentation: “You can use Google Cloud Organization Policy custom constraints to restrict specific operations on data lineage resources.”
- Dataform works with Organization Policy Service From the official documentation: “This document shows you how to use the [Organization Policy Service](/resource-manager/docs/organization-policy/overview) to restrict the pool of third-party remote Git repositories that Dataform repositories can connect to.”
- domain restricted sharing is part of Organization Policy Service From the official documentation: “Use the **Domain restricted sharing** (`iam.allowedPolicyMemberDomains`) or the `iam.managed.allowedPolicyMembers` organization policy constraint to define one or more Cloud Identity or Google Workspace customer IDs whose principals can be added to Identity and Access…”
- GKE works with Organization Policy Service From the official documentation: “The following limitations apply to using the Organization Policy Service with GKE:”
- Organization Policy Service configures Compute Engine From the official documentation: “You can use organization policies to enforce constraints on how Compute Engine resources, such as virtual machine (VM) instances, disks, and networks, are configured.”
- resource locations constraint is part of Organization Policy Service From the official documentation: “If you have an [organization policy](/resource-manager/docs/organization-policy/overview) that includes the resource locations [constraint](/resource-manager/docs/organization-policy/understanding-constraints), any snapshot storage location that you specify must be in the set…”
- Resource Manager configures Organization Policy Service From the official documentation: “Resources and methods for managing the Organization Policy Service can be found in the v1 [Resource Manager API](/resource-manager/docs).”
- Restrict TLS Versions is part of Organization Policy Service From the official documentation: “To configure this control, use the **Restrict TLS Versions** (`gcp.restrictTLSVersion`) organization policy constraint.”
- VPC Service Controls secures Organization Policy Service From the official documentation: “The API for Organization Policy Service can be protected by VPC Service Controls and the product can be used normally inside service perimeters.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- BigQuery works with Dataform From the official documentation: “You can define custom SQL commands for Dataform to run in BigQuery.”
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- BigQuery works with Cloud Monitoring From the official documentation: “You can use Monitoring to export your metrics to BigQuery.”
- Cloud Logging works with GKE From the official documentation: “Enable Cloud Logging on GKE Clusters”
- Compute Engine is an alternative to GKE From the official documentation: “To use TPU7x, you can use Google Kubernetes Engine (GKE) or Compute Engine.”
- Cloud Monitoring works with GKE From the official documentation: “Enable Cloud Monitoring on GKE Clusters”
- Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
- VPC Service Controls secures Cloud Storage From the official documentation: “Storage Transfer Service supports transfers to Cloud Storage buckets protected by VPC Service Controls.”
- Cloud Logging works with Cloud Storage From the official documentation: “Cloud Storage writes various log entries to Cloud Logging in the Google Cloud console.”
- Identity and Access Management secures BigQuery From the official documentation: “Access to BigQuery data from AlloyDB is managed through IAM.”
- Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
- BigQuery depends on Cloud Logging From the official documentation: “BigQuery utilizes Cloud Logging for some of your log data.”
- BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
- Cloud Logging works with Compute Engine From the official documentation: “Compute Engine sends you Cloud Logging events for scheduled, started, or completed maintenance.”
- Cloud Storage works with Compute Engine From the official documentation: “You can use a web browser, the Google Cloud CLI, or a programming language to transfer files between Cloud Storage and Compute Engine VMs.”
- GKE depends on Compute Engine From the official documentation: “For example, GKE deploys clusters on Compute Engine VMs.”
- BigQuery works with Workflows From the official documentation: “To learn more about using Workflows with BigQuery, see [Run multiple BigQuery jobs in parallel](/workflows/docs/tutorials/bigquery-parallel-jobs).”
- Cloud Logging works with Cloud Monitoring From the official documentation: “If a log entry matches the filter of the alerting policy, then Cloud Logging extracts labels and forwards the data to Cloud Monitoring.”
- Cloud Monitoring works with Compute Engine From the official documentation: “Many Google services like Compute Engine send telemetry to Cloud Monitoring.”
- Identity and Access Management secures Compute Engine From the official documentation: “Compute Engine uses Identity and Access Management (IAM) for authorization.”
- Identity and Access Management secures Dataform From the official documentation: “Dataform uses [Identity and Access Management (IAM)](/iam/docs) for access control.”
- Identity and Access Management works with VPC Service Controls From the official documentation: “VPC Service Controls perimeters and Identity and Access Management (IAM) roles work together.”
- Identity and Access Management secures Workflows From the official documentation: “This page describes the Identity and Access Management (IAM) roles and permissions available to control access to Workflows resources.”
- VPC Service Controls secures Compute Engine From the official documentation: “To further protect your Compute Engine resources, you can protect them using [VPC Service Controls](/vpc-service-controls/docs/overview).”
- VPC Service Controls secures Dataform From the official documentation: “If you use VPC Service Controls, you must configure the perimeter to protect Dataform and BigQuery.”
- VPC Service Controls works with Workflows From the official documentation: “You can use VPC Service Controls with Workflows to help protect your services.”
- BigQuery depends on Cloud Storage From the official documentation: “BigQuery relies on Cloud Storage for staging file data and supports reading from and writing to several other sources and Google Cloud services.”
- BigQuery works with Compute Engine From the official documentation: “Compute Engine integrates with Google Cloud technologies such as Cloud Storage, Google Kubernetes Engine, and BigQuery, to extend beyond the basic computational capability to create more complex and sophisticated applications.”
- BigQuery works with GKE From the official documentation: “Subsequently, by integrating BigQuery with GKE, you can use BigQuery to efficiently handle massive datasets (like Google Analytics) and the model's natural language understanding capabilities to generate meaningful insights.”
- BigQuery works with VPC Service Controls From the official documentation: “BigQuery integrates with VPC Service Controls to restrict access to your BigQuery resources from specific networks.”
- Cloud Logging is an alternative to Cloud Monitoring From the official documentation: “To see the status of your invalidation request or find a definitive list of recently submitted requests, you can use Cloud Logging or Cloud Monitoring.”
- Cloud Logging is an alternative to Cloud Storage From the official documentation: “When you specify your own service account for builds, you must store your build logs either in Cloud Logging or in a user-created Cloud Storage bucket.”
- Cloud Logging works with custom constraints From the official documentation: “The following table lists the Cloud Logging resources that you can reference in custom constraints.”
- Cloud Logging works with Dataform From the official documentation: “To enhance security, Dataform checks if the `iam.serviceAccounts.actAs` permission is missing on the service accounts used by Dataform resources. The results of these checks, including any potential permission issues, are recorded in Cloud Logging.”
- Cloud Logging works with VPC Service Controls From the official documentation: “This page describes how you can find VPC Service Controls errors using Cloud Logging.”
- Cloud Logging works with Workflows From the official documentation: “Workflows automatically generates execution logs for workflow executions in Cloud Logging.”
- Cloud Monitoring works with custom constraints From the official documentation: “The following table lists the Cloud Monitoring resources that you can reference in custom constraints.”
- Cloud Monitoring works with Dataform From the official documentation: “2. **[Cloud Monitoring integration](/monitoring/docs)**: Track Dataform pipeline metrics, such as execution durations, active compilations, and workflow job failure rates, through custom dashboard panels.”
- Cloud Monitoring depends on Identity and Access Management From the official documentation: “To use Monitoring, you must have the appropriate [Identity and Access Management](/iam/docs/overview) (IAM) permissions.”
- Cloud Monitoring works with VPC Service Controls From the official documentation: “Cloud Monitoring performs the VPC perimeter check when a project is *added* to a metrics scope:”
- Cloud Monitoring works with Workflows From the official documentation: “Use [Monitoring](/monitoring/docs) to get visibility into the performance, uptime, and overall health of your workflows.”
- Cloud Storage works with custom constraints From the official documentation: “The following table lists the Cloud Storage resources that you can reference in custom constraints.”
- Cloud Storage works with Dataform From the official documentation: “Dataform writes the output of scheduled notebook runs to the [Cloud Storage bucket](/storage/docs/buckets) selected during schedule creation.”
- Cloud Storage works with GKE From the official documentation: “Route Cloud Storage events to GKE”
- Cloud Storage works with Workflows From the official documentation: “Route Cloud Storage events to Workflows”
- Compute Engine works with custom constraints From the official documentation: “For Compute Engine, you can set custom constraints on the following resources and fields.”
- Compute Engine works with GKE From the official documentation: “For example, Google Kubernetes Engine (GKE) can cause usage in Compute Engine.”
- Compute Engine works with Workflows From the official documentation: “You can automate the execution of a long-running container using Workflows and Compute Engine.”
How learners score on this topic
Last updated