Question

Your organization is bootstrapping its Google Cloud resource hierarchy. Leadership requires that all production workloads for the finance department enforce a policy denying the creation of external IP addresses, while a separate sandbox environment used by developers must allow external IPs for experimentation. You want to design the folder structure and apply organization policies with the least administrative overhead and no risk of the sandbox setting affecting production. How should you structure the hierarchy and apply the constraint?

Accepted Answer

Create a 'finance-prod' folder and a 'sandbox' folder under the organization node; apply the constraints/compute.vmExternalIpAccess deny policy at the 'finance-prod' folder and leave the 'sandbox' folder to inherit the org default.

Answer

Apply the constraints/compute.vmExternalIpAccess deny policy at the organization node, then set an override policy allowing external IPs on every individual project in the sandbox environment.

Answer

Create a single shared folder for both environments and apply the deny policy at the project level only for finance production projects, leaving sandbox projects without any policy.

Answer

Apply the deny policy at the organization node and use IAM Conditions on the sandbox service accounts to grant an exception for creating external IPs.