Organization Policy Study Notes

The Organization Policy Service lets administrators enforce guardrails across the entire resource hierarchy using constraints. Unlike IAM, which controls who can act, organization policies control what configurations are allowed anywhere in an organization, folder, or project. Administrators use it to encode compliance rules once and have them apply consistently as new folders and projects are created.

Key facts

• A constraint is a type of restriction, such as requiring OS Login, disabling service account key creation, or restricting VM external IPs.
• Policies are set at the organization, folder, or project level and are inherited downward unless a child explicitly overrides or merges them.
• Boolean constraints are either enforced or not enforced, while list constraints allow or deny specific values such as regions, services, or machine types.
• Common exam constraints include constraints/compute.requireOsLogin, constraints/iam.disableServiceAccountKeyCreation, and constraints/storage.uniformBucketLevelAccess.
• Organization policies apply even to users with Owner roles, because they limit what configurations any principal is permitted to create.
• The Organization Policy Administrator role is required to set policies; the Organization Policy Viewer role can only read them.
• Dry run mode, available for supported constraints, lets you evaluate the effect of a policy and see violations without actually blocking actions.
• Google also provides managed constraints and, for some services, custom constraints defined with CEL for organization-specific rules.
• When policies merge, list values from parent and child can combine, while a child policy marked to override replaces the parent values entirely.

What the exam expects you to know

• Identify Organization Policy as the answer when a requirement must hold for all projects, including future ones, regardless of project owners.
• Match common constraints to scenarios: block external IPs, force uniform bucket-level access, disable key creation, or restrict resource locations.
• Explain inheritance: a folder policy applies to all projects in that folder unless a project policy overrides it where allowed.
• Distinguish policy enforcement from IAM permission: a user may have permission to create a VM but be blocked by a constraint on external IPs.
• Know that location restriction constraints can limit deployments to specific regions for compliance or data residency requirements.
• Recognize tags and conditional policies, where a constraint applies only to resources carrying a specific tag value.

Organization Policy vs Cloud IAM: when to use which

Choose Organization Policy to set a rule nobody can configure around, such as 'no bucket may use legacy ACLs' or 'VMs in this folder cannot have external IPs.' Choose IAM to decide which people or services receive which permissions. IAM grants capability, Organization Policy removes options from the platform entirely. In exam scenarios, phrases like 'enforce for all projects,' 'prevent any user from,' or 'ensure compliance across the organization' point to Organization Policy. Phrases like 'allow the support team to view logs' point to IAM role bindings instead. See also the Cloud IAM notes.

Useful gcloud commands

gcloud org-policies list --organization=ORGANIZATION_ID
gcloud org-policies describe constraints/compute.requireOsLogin --organization=ORGANIZATION_ID
gcloud resource-manager org-policies set-policy policy.yaml --organization=ORGANIZATION_ID

Common exam traps

• Organization Policy does not grant permissions; setting a policy never gives a user access, it only restricts what configurations are permitted.
• A constraint that exists in Google's catalog does nothing until an administrator sets a policy enforcing it on a node in the hierarchy.
• Policies generally affect new and changed resources; already-existing non-compliant resources may remain until modified, which surprises many candidates.
• Project owners cannot bypass an organization constraint by granting themselves more IAM roles, because policy evaluation is separate from permission checks.

Frequently asked questions

What is the difference between a constraint and a policy?

A constraint is the definition of a restriction type that Google provides, such as restricting VM external IPs. A policy is your configuration of that constraint on an organization, folder, or project, saying whether it is enforced and with what values. One constraint can have different policies at different hierarchy levels.

Can a folder policy differ from the organization policy?

Yes, administrators can set a policy on a folder that overrides or merges with the organization policy for projects inside that folder. This lets a development folder be more permissive than a production folder. Some constraints support conditional application using tags, so the exception applies only to tagged resources.

How do I stop service account keys from being created?

Enforce the boolean constraint constraints/iam.disableServiceAccountKeyCreation at the organization or folder level. Once enforced, attempts to create downloadable keys fail for all users in scope, pushing teams toward impersonation and workload identity. A companion constraint can also block uploading public keys for service accounts.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.