Question

A company organizes its GCP resources with an organization node, a 'Production' folder, and a 'Sandbox' folder. At the organization level, the security team sets the 'constraints/compute.vmExternalIpAccess' list constraint to deny all values, preventing external IPs on VMs. The development team needs VMs with external IPs only within a specific project inside the 'Sandbox' folder for a public demo, without weakening the restriction anywhere else. What is the most appropriate way to achieve this?

Accepted Answer

Set an organization policy on the specific demo project that overrides the inherited policy by allowing the required VM instances' external IP values.

Answer

Remove the organization-level policy and re-apply the deny constraint on the 'Production' folder only, leaving 'Sandbox' unrestricted.

Answer

Grant the development team the 'roles/orgpolicy.policyAdmin' role at the organization level so they can adjust the constraint as needed.

Answer

Add an IAM deny policy at the project level to explicitly permit external IP assignment for the demo VMs.