Organization policies in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the constraint when creating an organization policy.

GCP

resource "google_org_policy_policy" "example" {
  org_id    = "123456789"
  constraint = "[1]"
}

Drag options to blanks, or click blank then click option'

Aconstraints/compute.disableSerialPortAccess

Bprojects/my-project

Cfolders/1234

Droles/editor

Attempts:

3 left

💡 Hint

Common Mistakes

Using project or folder IDs instead of a constraint name.

Using role names instead of constraints.

The constraint field must specify a valid organization policy constraint, such as constraints/compute.disableSerialPortAccess.

2fill in blank

medium

Complete the code to set the policy to deny serial port access.

GCP

resource "google_org_policy_policy" "example" {
  org_id    = "123456789"
  constraint = "constraints/compute.disableSerialPortAccess"
  boolean_policy {
    enforced = [1]
  }
}

Drag options to blanks, or click blank then click option'

A1

Bfalse

C"true"

Dtrue

Attempts:

3 left

💡 Hint

Common Mistakes

Using string 'true' instead of boolean true.

Setting enforced to false which disables the policy.

The enforced field must be set to true to deny serial port access.

3fill in blank

hard

Fix the error in the policy definition by completing the missing field.

GCP

resource "google_org_policy_policy" "example" {
  org_id    = "123456789"
  [1] = "constraints/compute.disableSerialPortAccess"
  boolean_policy {
    enforced = true
  }
}

Drag options to blanks, or click blank then click option'

Apolicy_id

Borg_id

Cconstraint

Dname

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'name' or 'policy_id' instead of 'constraint'.

Repeating 'org_id' field.

The field constraint is required to specify which policy constraint to apply.

4fill in blank

hard

Fill both blanks to create a list policy that allows only specific VM machine types.

GCP

resource "google_org_policy_policy" "example" {
  org_id    = "123456789"
  constraint = "constraints/compute.restrictMachineTypes"
  list_policy {
    [1] = ["n1-standard-1", "e2-medium"]
    [2] = false
  }
}

Drag options to blanks, or click blank then click option'

Aallowed_values

Bdenied_values

Call_values

Dinherit_from_parent

Attempts:

3 left

💡 Hint

Common Mistakes

Using denied_values when intending to allow.

Setting all_values to true which allows all values.

The allowed_values field lists permitted values, and all_values must be set to false to enforce the allowed list (whitelist).

5fill in blank

hard

Fill all three blanks to define a policy that denies specific service accounts from being used.

GCP

resource "google_org_policy_policy" "example" {
  org_id    = "123456789"
  constraint = "[1]"
  list_policy {
    [2] = ["serviceAccount:[e-mail]"]
    [3] = false
  }
}

Drag options to blanks, or click blank then click option'

Aconstraints/iam.allowedPolicyMembers

Bdenied_values

Call_values

Dallowed_values

Attempts:

3 left

💡 Hint

Common Mistakes

Using allowed_values instead of denied_values.

Setting all_values to true instead of false.

The constraint for IAM allowed policy members specifies the policy type, denied_values lists the disallowed accounts, and all_values set to false to enforce the denied list (blacklist).