Enforce Restrict Service Usage Api Key Restrictions

What Restrict Service Usage and API Key Restrictions Are

The Restrict Service Usage constraint (constraints/gcp.restrictServiceUsage) is a predefined Google Cloud Organization Policy list constraint that controls which Google Cloud services and APIs can be enabled and used within a specific resource hierarchy container (Organization, Folder, or Project). In parallel, API Key Restrictions provide granular defense-in-depth controls for credentials by restricting requests based on client context (such as IP addresses, HTTP referrers, or mobile app fingerprints) and restricting target API invocation scope.

How it meets the requirements

• Requirement 1 (Enforce API allowlist across hierarchy): Applying constraints/gcp.restrictServiceUsage at the Development folder with spec.rules.allow.values containing authorized service names (e.g., compute.googleapis.com, storage.googleapis.com) establishes an inheritance guardrail. Project owners within this folder cannot enable or make API calls to unapproved Google Cloud services, even if they possess project-level roles/serviceusage.serviceUsageAdmin privileges.
• Requirement 2 (Granular API key protection): Configuring the API key with IP address application restrictions ensures that only requests originating from the designated backend server IP addresses/CIDR blocks are accepted. Adding API restrictions to the key ensures that the credential can only execute calls against the specified backend API service, mitigating token abuse if the key is compromised.

Key advantages and capabilities

• Centralized Guardrails: Organization policies operate above IAM, preventing project-level administrators from bypassing corporate service governance.
• Inheritance & Hierarchy: Enforcing the policy at the Development folder automatically cascades down to all current and future projects in that folder.
• Defense-in-Depth for API Keys: Combining application-level restrictions (IP addresses) with API target restrictions limits both where requests come from and what services can be invoked.
• Exfiltration & Abuse Prevention: Prevents unauthorized shadow cloud service deployment and limits the blast radius of exposed credentials.

Why this is optimal

This approach uses native Google Cloud resource hierarchy guardrails for service enablement and follows security best practices for API credential scoping without requiring custom infrastructure proxies.