/google-cloud-recipe-foundation-builder

Google Cloud Organization Policies Reference

This reference document details the baseline Organization Policies enforced by the google-cloud-recipe-foundation-builder recipe. It provides the specific constraint names, whether they are Boolean or List types, their target configurations, and standard YAML templates for deployment.

Table of Contents

• Overview of Constraints (L20-L24)
• Enforced Boolean Constraints (L26-L101)
• List Constraints (L102-L173)
  • VM External IP Access (L108-L120)
  • Restrict Protocol Forwarding Creation (L121-L136)
  • Allowed Policy Member Domains (L137-L155)
  • Allowed Contact Domains (L156-L171)
• Deployment Directive (L174-L186)

Overview of Constraints

The baseline security posture enforces Boolean constraints (set to Enforced) and List constraints (restricting allowed or denied values).

Enforced Boolean Constraints

These policies are binary and are set to enforce: true.

Target YAML Structure

For all Boolean constraints, use the following YAML template. Replace [ORGANIZATION_ID] and [CONSTRAINT_NAME] accordingly.

name: organizations/[ORGANIZATION_ID]/policies/[CONSTRAINT_NAME]
spec:
  rules:
  - enforce: true

List of Boolean Constraints

1. Disable Automatic IAM Grants for Default Service Accounts
   • Constraint: iam.automaticIamGrantsForDefaultServiceAccounts
   • Description: Prevents the default App Engine and Compute Engine service accounts from automatically being granted the Editor role on your projects.
2. Public Access Prevention
   • Constraint: storage.publicAccessPrevention
   • Description: Enforces public access prevention on all Cloud Storage buckets in the organization, blocking public access via IAM policies.
3. Set New Project Default to Zonal DNS Only
   • Constraint: compute.setNewProjectDefaultToZonalDNSOnly
   • Description: Ensures that new projects use only zonal DNS names for Compute Engine instances, preventing internal DNS name leakage across zones.
4. Uniform Bucket-Level Access
   • Constraint: storage.uniformBucketLevelAccess
   • Description: Enforces uniform bucket-level access on all Cloud Storage buckets, disabling fine-grained ACLs and relying solely on IAM.
5. Restrict Public IP Access for Cloud SQL
   • Constraint: sql.restrictPublicIp
   • Description: Prevents Cloud SQL instances from being created with public IP addresses, enforcing private IP connectivity.
6. Disable Service Account Key Creation
   • Constraint: iam.disableServiceAccountKeyCreation
   • Description: Prevents users from creating new external service account keys, reducing the risk of credential leakage.
7. Disable Serial Port Access
   • Constraint: compute.disableSerialPortAccess
   • Description: Disables serial port access to all Compute Engine virtual machine instances, securing the console access.
8. Restrict Shared VPC Project Lien Removal
   • Constraint: compute.restrictXpnProjectLienRemoval
   • Description: Restricts the removal of liens on host projects for Shared VPC, preventing accidental deletion of critical networking projects.
9. Disable VPC External IPv6
   • Constraint: compute.disableVpcExternalIpv6
   • Description: Prevents the allocation of external IPv6 addresses to VPC subnets and resources, limiting external exposure.
10. Disable Nested Virtualization
    • Constraint: compute.disableNestedVirtualization
    • Description: Disables hardware-assisted nested virtualization on Compute Engine VMs, mitigating side-channel attack vectors.
11. Disable Service Account Key Upload
    • Constraint: iam.disableServiceAccountKeyUpload
    • Description: Prevents users from uploading public keys to service accounts, blocking external key association.
12. Require OS Login
    • Constraint: compute.requireOsLogin
    • Description: Enforces OS Login on all Compute Engine instances, linking VM SSH access to the user's Google identity.
13. Restrict Authorized Networks for Cloud SQL
    • Constraint: sql.restrictAuthorizedNetworks
    • Description: Blocks the addition of non-private IP ranges to the authorized networks list of Cloud SQL instances.

List Constraints

List constraints define specific allowed or denied values. Use the specific templates below for each policy.

VM External IP Access (Deny All)

• Constraint: compute.vmExternalIpAccess

• Description: Prevents Compute Engine VMs from being assigned external (public) IP addresses.

• YAML Template:

  name: organizations/[ORGANIZATION_ID]/policies/compute.vmExternalIpAccess
  spec:
    rules:
    - denyAll: true

Restrict Protocol Forwarding Creation (Allow INTERNAL)

• Constraint: compute.restrictProtocolForwardingCreationForTypes

• Description: Restricts protocol forwarding rule creation to internal targets only.

• YAML Template:

  name: organizations/[ORGANIZATION_ID]/policies/compute.restrictProtocolForwardingCreationForTypes
  spec:
    rules:
    - values:
        allowedValues:
        - INTERNAL

Allowed Policy Member Domains (Allow Customer ID)

• Constraint: iam.allowedPolicyMemberDomains

• Description: Restricts the domain identities that can be added to IAM policies to your specific Google Workspace or Cloud Identity customer ID.

• YAML Template:

  name: organizations/[ORGANIZATION_ID]/policies/iam.allowedPolicyMemberDomains
  spec:
    rules:
    - values:
        allowedValues:
        - [DIRECTORY_CUSTOMER_ID] # Replace with your numeric customer ID (e.g., C01234567)

  (Note: Alternatively, you can use the principal set format: principalSet://iam.googleapis.com/organizations/[ORGANIZATION_ID])

Allowed Contact Domains (Allow Org Domain)

• Constraint: essentialcontacts.allowedContactDomains

• Description: Restricts the domains that can be registered as essential contacts for the organization to your official domain.

• YAML Template:

  name: organizations/[ORGANIZATION_ID]/policies/essentialcontacts.allowedContactDomains
  spec:
    rules:
    - values:
        allowedValues:
        - @[YOUR_DOMAIN] # Replace with your organization's domain (e.g., @example.com)

Deployment Directive

Apply these policies sequentially using the gcloud org-policies set-policy command:

gcloud org-policies set-policy [POLICY_FILE_NAME].yaml

[!CAUTION] Applying iam.allowedPolicyMemberDomains first can lock out the deployment identity if it resides in an unallowed domain. Ensure the deployment identity is safe before enforcing this policy.