Google Cloud Organization Policies

View Resource Hierarchy

# Get organization ID
gcloud organizations list

# List folders in organization
gcloud resource-manager folders list --organization=ORGANIZATION_ID

# List projects in organization
gcloud projects list --filter="parent.id=ORGANIZATION_ID"

# View current project hierarchy
gcloud projects describe PROJECT_ID

# List all accessible projects
gcloud projects list --format="table(
  name,
  projectId,
  projectNumber,
  parent.id,
  parent.type
)"

Common Built-in Constraints

# List all available constraints
gcloud resource-manager org-policies list --organization=ORGANIZATION_ID

# Common security constraints:
# compute.disableSerialPortAccess - Disable VM serial port access
# compute.vmExternalIpAccess - Restrict external IP assignment
# storage.publicAccessPrevention - Prevent public access to Cloud Storage
# iam.disableServiceAccountKeyCreation - Prevent service account key creation
# compute.restrictSharedVpcSubnetworks - Restrict shared VPC subnet usage

# View constraint details
gcloud resource-manager org-policies describe \
  constraints/compute.vmExternalIpAccess \
  --organization=ORGANIZATION_ID

disable-vm-serial-port.yaml

constraint: constraints/compute.disableSerialPortAccess
booleanPolicy:
  enforced: true

restrict-vm-external-ip.yaml

constraint: constraints/compute.vmExternalIpAccess
listPolicy:
  allowedValues:
    - projects/PROJECT_ID/zones/us-central1-a/instances/bastion-host
  deniedValues: []
  allValues: DENY

allowed-locations.yaml

constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - in:us-locations
    - in:eu-locations
  deniedValues: []
  allValues: DENY

Apply Policies

# Apply policy at organization level
gcloud resource-manager org-policies set-policy \
  disable-vm-serial-port.yaml \
  --organization=ORGANIZATION_ID

# Apply policy at folder level
gcloud resource-manager org-policies set-policy \
  restrict-vm-external-ip.yaml \
  --folder=FOLDER_ID

# Apply policy at project level
gcloud resource-manager org-policies set-policy \
  allowed-locations.yaml \
  --project=PROJECT_ID

# View effective policy
gcloud resource-manager org-policies describe \
  constraints/compute.disableSerialPortAccess \
  --organization=ORGANIZATION_ID \
  --effective

# List all policies for an organization
gcloud resource-manager org-policies list \
  --organization=ORGANIZATION_ID \
  --show-unset

Install Config Validator

# Install using Go
go install github.com/GoogleCloudPlatform/config-validator/cmd/validator@latest

# Or download binary
curl -L https://github.com/GoogleCloudPlatform/config-validator/releases/latest/download/validator-linux-amd64 \
  -o validator
chmod +x validator
sudo mv validator /usr/local/bin/

# Verify installation
validator --version

gcp-storage-location-constraint.yaml

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: gcpstoragelocationconstraint
spec:
  crd:
    spec:
      names:
        kind: GcpStorageLocationConstraint
      validation:
        properties:
          locations:
            type: array
            items:
              type: string
          exemptions:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package gcpstoragelocationconstraint

        required_locations := input.parameters.locations
        exemptions := input.parameters.exemptions

        violation[{"msg": msg}] {
          resource := input.review.object
          resource.kind == "StorageBucket"
          
          # Check if bucket is in exemptions
          not bucket_in_exemptions(resource.metadata.name)
          
          # Check if location is allowed
          not location_allowed(resource.spec.location)
          
          msg := sprintf("Storage bucket '%v' location '%v' is not in allowed locations: %v", 
            [resource.metadata.name, resource.spec.location, required_locations])
        }

        bucket_in_exemptions(bucket_name) {
          bucket_name == exemptions[_]
        }

        location_allowed(location) {
          location == required_locations[_]
        }

        location_allowed(location) {
          startswith(location, required_locations[_])
        }

storage-location-policy.yaml

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: GcpStorageLocationConstraint
metadata:
  name: storage-must-be-in-allowed-locations
spec:
  match:
    kinds:
      - apiGroups: ["storage.cnrm.cloud.google.com"]
        kinds: ["StorageBucket"]
  parameters:
    locations:
      - "us-central1"
      - "us-east1"
      - "europe-west1"
    exemptions:
      - "legacy-backup-bucket"
      - "temp-migration-bucket"

test-terraform-config.tf

# Compliant storage bucket
resource "google_storage_bucket" "compliant_bucket" {
  name          = "my-compliant-bucket"
  location      = "us-central1"
  force_destroy = true

  lifecycle_rule {
    condition {
      age = 365
    }
    action {
      type = "Delete"
    }
  }
}

# Non-compliant storage bucket (will fail validation)
resource "google_storage_bucket" "non_compliant_bucket" {
  name          = "my-non-compliant-bucket"
  location      = "asia-southeast1"  # Not in allowed locations
  force_destroy = true
}

Validate Configuration

# Generate Terraform plan
terraform plan -out=tfplan
terraform show -json tfplan > tfplan.json

# Convert to CAI (Cloud Asset Inventory) format
terraform-validator convert tfplan.json

# Validate against constraints
validator validate \
  --policy-path=constraints/ \
  --data=tfplan.json

# Alternative: Use Terraform Validator
terraform-validator validate tfplan.json \
  --policy-path=constraints/ \
  --project=PROJECT_ID

network-security-constraint.yaml

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: gcpnetworksecurityconstraint
spec:
  crd:
    spec:
      names:
        kind: GcpNetworkSecurityConstraint
      validation:
        properties:
          blocked_ports:
            type: array
            items:
              type: string
          allowed_source_ranges:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package gcpnetworksecurityconstraint

        blocked_ports := input.parameters.blocked_ports
        allowed_source_ranges := input.parameters.allowed_source_ranges

        violation[{"msg": msg}] {
          resource := input.review.object
          resource.kind == "ComputeFirewall"
          
          # Check for blocked ports
          some i
          port := resource.spec.allow[i].ports[_]
          port == blocked_ports[_]
          
          # Check if source ranges are too permissive
          some j
          source_range := resource.spec.sourceRanges[j]
          not source_range_allowed(source_range)
          
          msg := sprintf("Firewall rule '%v' allows blocked port '%v' from unauthorized source range '%v'", 
            [resource.metadata.name, port, source_range])
        }

        source_range_allowed(source_range) {
          source_range == allowed_source_ranges[_]
        }

        # Allow private IP ranges by default
        source_range_allowed(source_range) {
          private_ranges := ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
          startswith(source_range, private_ranges[_])
        }

iam-security-constraint.yaml

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: gcpiamsecurityconstraint
spec:
  crd:
    spec:
      names:
        kind: GcpIamSecurityConstraint
      validation:
        properties:
          prohibited_roles:
            type: array
            items:
              type: string
          required_conditions:
            type: array
            items:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package gcpiamsecurityconstraint

        prohibited_roles := input.parameters.prohibited_roles
        required_conditions := input.parameters.required_conditions

        violation[{"msg": msg}] {
          resource := input.review.object
          resource.kind == "IAMPolicy"
          
          # Check for prohibited roles
          some i
          binding := resource.spec.bindings[i]
          binding.role == prohibited_roles[_]
          
          msg := sprintf("IAM policy '%v' contains prohibited role '%v'", 
            [resource.metadata.name, binding.role])
        }

        violation[{"msg": msg}] {
          resource := input.review.object
          resource.kind == "IAMPolicy"
          
          # Check for missing conditions on sensitive roles
          some i
          binding := resource.spec.bindings[i]
          is_sensitive_role(binding.role)
          not has_condition(binding)
          
          msg := sprintf("IAM policy '%v' grants sensitive role '%v' without conditions", 
            [resource.metadata.name, binding.role])
        }

        is_sensitive_role(role) {
          sensitive_roles := [
            "roles/owner",
            "roles/editor", 
            "roles/iam.securityAdmin",
            "roles/resourcemanager.organizationAdmin"
          ]
          role == sensitive_roles[_]
        }

        has_condition(binding) {
          binding.condition
        }

cloudbuild.yaml

steps:
# Install dependencies
- name: 'gcr.io/cloud-builders/gcloud'
  entrypoint: 'bash'
  args:
  - '-c'
  - |
    # Install terraform-validator
    curl -L https://github.com/GoogleCloudPlatform/terraform-validator/releases/latest/download/terraform-validator-linux-amd64 \
      -o terraform-validator
    chmod +x terraform-validator
    
    # Install Config Validator
    curl -L https://github.com/GoogleCloudPlatform/config-validator/releases/latest/download/validator-linux-amd64 \
      -o validator
    chmod +x validator

# Terraform validation
- name: 'hashicorp/terraform:1.6'
  entrypoint: 'sh'
  args:
  - '-c'
  - |
    terraform init
    terraform validate
    terraform plan -out=tfplan
    terraform show -json tfplan > tfplan.json
  volumes:
  - name: 'tf-plan'
    path: '/workspace'

# Policy validation
- name: 'gcr.io/cloud-builders/gcloud'
  entrypoint: 'bash'
  args:
  - '-c'
  - |
    # Validate using terraform-validator
    ./terraform-validator validate tfplan.json \
      --policy-path=constraints/ \
      --project=$PROJECT_ID \
      --format=json > validation-results.json
    
    # Check if there are violations
    violations=$(cat validation-results.json | jq length)
    if [ $violations -gt 0 ]; then
      echo "Policy violations found:"
      cat validation-results.json | jq '.'
      exit 1
    else
      echo "All policy validations passed!"
    fi
  volumes:
  - name: 'tf-plan'
    path: '/workspace'

# Deploy if validation passes
- name: 'hashicorp/terraform:1.6'
  entrypoint: 'sh'
  args:
  - '-c'
  - |
    if [ "$BRANCH_NAME" = "main" ]; then
      terraform apply tfplan
    else
      echo "Skipping deployment for branch: $BRANCH_NAME"
    fi
  volumes:
  - name: 'tf-plan'
    path: '/workspace'

# Generate compliance report
- name: 'gcr.io/cloud-builders/gcloud'
  entrypoint: 'bash'
  args:
  - '-c'
  - |
    # Generate organization policy compliance report
    gcloud logging read \
      'resource.type="organization" AND protoPayload.methodName="SetOrgPolicy"' \
      --limit=50 \
      --format=json > policy-changes.json
    
    # Store results in Cloud Storage
    gsutil cp validation-results.json gs://${PROJECT_ID}-compliance-reports/
    gsutil cp policy-changes.json gs://${PROJECT_ID}-compliance-reports/

options:
  logging: CLOUD_LOGGING_ONLY

.github/workflows/gcp-policy-validation.yml

name: GCP Policy Validation

on:
  pull_request:
    paths:
      - '**.tf'
      - 'constraints/**'
      - 'policies/**'

env:
  GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
  GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}

jobs:
  policy-validation:
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v3
      with:
        terraform_version: 1.6.0
    
    - name: Authenticate to Google Cloud
      uses: google-github-actions/auth@v2
      with:
        credentials_json: ${{ secrets.GCP_SA_KEY }}
    
    - name: Set up Cloud SDK
      uses: google-github-actions/setup-gcloud@v2
    
    - name: Install terraform-validator
      run: |
        curl -L https://github.com/GoogleCloudPlatform/terraform-validator/releases/latest/download/terraform-validator-linux-amd64 \
          -o terraform-validator
        chmod +x terraform-validator
        sudo mv terraform-validator /usr/local/bin/
    
    - name: Install Config Validator
      run: |
        curl -L https://github.com/GoogleCloudPlatform/config-validator/releases/latest/download/validator-linux-amd64 \
          -o validator
        chmod +x validator
        sudo mv validator /usr/local/bin/
    
    - name: Terraform Init and Plan
      run: |
        terraform init
        terraform plan -out=tfplan
        terraform show -json tfplan > tfplan.json
    
    - name: Validate with terraform-validator
      run: |
        echo "🔍 Running terraform-validator..."
        terraform-validator validate tfplan.json \
          --policy-path=constraints/ \
          --project=$GCP_PROJECT_ID \
          --format=json > tv-results.json
        
        # Check results
        violations=$(cat tv-results.json | jq length)
        if [ $violations -gt 0 ]; then
          echo "❌ Policy violations found:"
          cat tv-results.json | jq '.'
          exit 1
        else
          echo "✅ All terraform-validator checks passed!"
        fi
    
    - name: Validate with Config Validator
      run: |
        echo "🛡️ Running Config Validator..."
        if ! validator validate --policy-path=constraints/ --data=tfplan.json; then
          echo "❌ Config Validator found policy violations"
          exit 1
        else
          echo "✅ All Config Validator checks passed!"
        fi
    
    - name: Test Organization Policies
      run: |
        echo "📋 Testing Organization Policy changes..."
        
        # Dry run policy changes if they exist
        if [ -d "org-policies/" ]; then
          find org-policies/ -name "*.yaml" | while read policy; do
            echo "Testing policy: $policy"
            gcloud resource-manager org-policies set-policy \
              "$policy" \
              --organization=${{ secrets.GCP_ORG_ID }} \
              --dry-run
          done
        fi
    
    - name: Generate Policy Report
      if: always()
      run: |
        echo "## 📊 GCP Policy Validation Report" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        
        # terraform-validator results
        if [ -f tv-results.json ]; then
          violations=$(cat tv-results.json | jq length)
          if [ $violations -eq 0 ]; then
            echo "✅ **terraform-validator**: All checks passed" >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ **terraform-validator**: $violations violations found" >> $GITHUB_STEP_SUMMARY
            echo "```json" >> $GITHUB_STEP_SUMMARY
            cat tv-results.json | jq '.' >> $GITHUB_STEP_SUMMARY
            echo "```" >> $GITHUB_STEP_SUMMARY
          fi
        fi
        
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "### Resources to be created:" >> $GITHUB_STEP_SUMMARY
        jq -r '.planned_values.root_module.resources[]? | "\(.type): \(.name)"' tfplan.json >> $GITHUB_STEP_SUMMARY

Enable SCC and Asset Inventory

# Enable Security Command Center API
gcloud services enable securitycenter.googleapis.com

# Enable Cloud Asset Inventory API
gcloud services enable cloudasset.googleapis.com

# Create custom security source for policy violations
gcloud scc sources create \
  --organization=ORGANIZATION_ID \
  --display-name="Policy Violations" \
  --description="Custom source for organization policy violations"

# Export asset inventory
gcloud asset export \
  --organization=ORGANIZATION_ID \
  --asset-types="cloudresourcemanager.googleapis.com/Project,compute.googleapis.com/Instance" \
  --output-path="gs://YOUR_BUCKET/asset-inventory.json" \
  --content-type=resource

compliance-monitor.py

#!/usr/bin/env python3
import json
import sys
from google.cloud import asset_v1
from google.cloud import securitycenter
from google.cloud import resourcemanager_v3

def check_compute_instances_compliance(organization_id):
    """Check Compute Engine instances for policy compliance."""
    
    client = asset_v1.AssetServiceClient()
    parent = f"organizations/{organization_id}"
    
    # Get all compute instances
    response = client.search_all_resources(
        request={
            "scope": parent,
            "asset_types": ["compute.googleapis.com/Instance"],
        }
    )
    
    violations = []
    
    for resource in response:
        instance = resource
        
        # Check for external IP policy violation
        if has_external_ip(instance):
            violations.append({
                "resource": instance.name,
                "violation": "Instance has external IP",
                "policy": "compute.vmExternalIpAccess"
            })
        
        # Check for OS Login requirement
        if not has_os_login(instance):
            violations.append({
                "resource": instance.name,
                "violation": "Instance does not have OS Login enabled",
                "policy": "compute.requireOsLogin"
            })
    
    return violations

def has_external_ip(instance):
    """Check if instance has external IP."""
    try:
        additional_attributes = json.loads(instance.additional_attributes)
        network_interfaces = additional_attributes.get("networkInterfaces", [])
        
        for interface in network_interfaces:
            access_configs = interface.get("accessConfigs", [])
            if access_configs:
                return True
        return False
    except:
        return False

def has_os_login(instance):
    """Check if instance has OS Login enabled."""
    try:
        additional_attributes = json.loads(instance.additional_attributes)
        metadata = additional_attributes.get("metadata", {})
        items = metadata.get("items", [])
        
        for item in items:
            if item.get("key") == "enable-oslogin" and item.get("value") == "TRUE":
                return True
        return False
    except:
        return False

def check_organization_policies(organization_id):
    """Check organization policy compliance."""
    
    client = resourcemanager_v3.OrgPolicyClient()
    parent = f"organizations/{organization_id}"
    
    # List all policies
    policies = client.list_policies(parent=parent)
    
    policy_status = []
    for policy in policies:
        policy_status.append({
            "constraint": policy.name.split("/")[-1],
            "enforced": bool(policy.spec),
            "inheritance": policy.spec.inherit_from_parent if policy.spec else False
        })
    
    return policy_status

def create_scc_finding(organization_id, source_id, violation):
    """Create Security Command Center finding for policy violation."""
    
    client = securitycenter.SecurityCenterClient()
    source_name = f"organizations/{organization_id}/sources/{source_id}"
    
    finding_id = f"policy-violation-{hash(violation['resource'])}"
    finding = {
        "name": f"{source_name}/findings/{finding_id}",
        "resource_name": violation["resource"],
        "state": securitycenter.Finding.State.ACTIVE,
        "category": "POLICY_VIOLATION",
        "source_properties": {
            "policy": violation["policy"],
            "violation": violation["violation"]
        }
    }
    
    response = client.create_finding(
        parent=source_name,
        finding_id=finding_id,
        finding=finding
    )
    
    return response

def main():
    if len(sys.argv) != 2:
        print("Usage: python compliance-monitor.py ")
        sys.exit(1)
    
    organization_id = sys.argv[1]
    
    print(f"Checking compliance for organization: {organization_id}")
    
    # Check compute instances
    compute_violations = check_compute_instances_compliance(organization_id)
    
    # Check organization policies
    policy_status = check_organization_policies(organization_id)
    
    # Generate report
    report = {
        "organization_id": organization_id,
        "compute_violations": compute_violations,
        "policy_status": policy_status,
        "total_violations": len(compute_violations)
    }
    
    print(json.dumps(report, indent=2))
    
    # Create SCC findings for violations
    # source_id = "YOUR_CUSTOM_SOURCE_ID"
    # for violation in compute_violations:
    #     create_scc_finding(organization_id, source_id, violation)

if __name__ == "__main__":
    main()

Google Cloud Governance Mastery

You now have comprehensive knowledge of Google Cloud governance including: