Question

Your organization has a folder named 'production' containing dozens of projects. Security requires that Compute Engine VMs may only be created with Shielded VM enabled, but a separate 'sandbox' folder must remain exempt so engineers can test legacy images. You want to enforce this using organization policy with the least ongoing administrative effort and without modifying individual project configurations. What should you do?

Accepted Answer

Apply the boolean constraint 'constraints/compute.requireShieldedVm' with 'enforced: true' at the 'production' folder, and leave the 'sandbox' folder at the default (not enforced).

Answer

Apply the boolean constraint 'constraints/compute.requireShieldedVm' with 'enforced: true' at the organization node, and add each sandbox project as an exception in the policy's condition list.

Answer

Create a custom IAM deny policy on the 'production' folder that blocks 'compute.instances.create' unless the request includes a Shielded VM attribute.

Answer

Enable the list constraint 'constraints/compute.trustedImageProjects' at the organization and manually audit VM creation logs in the sandbox folder.