Home › GCP Associate Cloud Engineer › cloudcomputing › gcpsetup › An organization wants every project in a specifi…
An organization wants every project in a specific folder to automatically inherit a policy that forbids creating public Cloud Storage buckets. Where should the policy be set so it applies to ALL current and future projects in that folder with minimal duplication?
ASet the constraint at the resource level on each VM
BApply the constraint at the user account level so it follows them around
CApply an organization policy with the `storage.publicAccessPrevention` constraint at the folder level — children inherit it
DApply the constraint individually to every existing bucket and every new bucket as it is created
Answer & Solution
Correct answer: C. Apply an organization policy with the `storage.publicAccessPrevention` constraint at the folder level — children inherit it
Organization policies are inherited down the hierarchy. Applying `storage.publicAccessPrevention` at the folder level cascades to every project (and bucket) inside it, present and future. Per-bucket or per-VM application doesn't scale; user-account-level constraints aren't a thing in this system.
Related questions
Which approach correctly captures Google Cloud's quota model for compute resources?Which IAM role type lets you define the exact list of permissions you want, instead of relA team wants to grant a contractor read-only access to a single Cloud Storage bucket and nCloud Identity vs Google Workspace — which statement is correct?A new application needs to call the BigQuery and Cloud Storage APIs in a project. The APIsWhich mechanism on Google Cloud lets a central admin enforce a rule like "no externally acWhich Google Cloud principal type is meant to authenticate workloads (e.g. a Compute EnginWhich Google Cloud Identity and Access Management (IAM) concept defines a SET of permissio