Question

A financial services company has a Google Cloud organization with a dedicated 'networking' folder containing Shared VPC host projects. The security team discovers that a developer in a separate 'apps' folder was able to attach their service project to a Shared VPC host project without approval. The team wants to ensure that only specifically designated host projects can be used as Shared VPC hosts across the organization, blocking all others by default. Which approach should they take?

Accepted Answer

Apply the 'constraints/compute.restrictSharedVpcHostProjects' list constraint at the organization node, denying all host projects, and add an allow entry for only the approved host project resource IDs

Answer

Grant the 'roles/compute.xpnAdmin' role only to the networking team at the folder level and remove it from all other principals

Answer

Enable the 'constraints/compute.disableSerialPortAccess' boolean constraint on the apps folder to prevent unauthorized service project attachment

Answer

Create an IAM deny policy that blocks the 'compute.subnetworks.setPrivateIpGoogleAccess' permission for all developers in the apps folder