Google Cloud Certified Professional-Cloud-Security-Engineer Google Study Notes

The action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in place and only members from the flowlogistic.com organization are allowed. The inheritFromParent: false property on the “Apps” folder means that it does not inherit the organization policy from the organization node. Therefore, only the policy set at the folder level applies, which allows only members from the flowlogistic.com organization. As a result, the attempt to grant access to the user testuser@terramearth.com fails because this user is not a member of the flowlogistic.com organization.

Compute Engine doesn't automatically update the OS or the software on your deployed instances. You will need to patch or update your deployed Compute Engine instances when necessary. However, in the cloud it is not recommended that you patch or update individual running instances. Instead it is best to patch the image that was used to launch the instance and then replace each affected instance with a new copy.

Objective: Provide evidence of access reviews for an upcoming audit.

Solution: Use Policy Analyzer to review and report on IAM policies.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the Policy Analyzer tool.

Step 3: Select the project for which you need to review access policies.

Step 4: Use the tool to generate reports on IAM roles and permissions.

Step 5: Export the reports as evidence for the audit.

Policy Analyzer provides detailed insights into IAM policies, helping you to review access configurations and generate necessary reports for compliance and auditing purposes.

References:

Policy Analyzer Documentation

Uniform bucket-level access allows you to manage permissions at the bucket level, rather than at the object level. This simplifies permission management and ensures that access to objects is controlled consistently via IAM roles, without allowing uploaders full control over the objects.

Steps:

Enable Uniform Bucket-Level Access: In the Google Cloud Console, enable uniform bucket-level access for the Cloud Storage bucket.

Configure IAM Policies: Assign appropriate IAM roles to users and groups to control access to the bucket.

Audit Logging: Enable Cloud Audit Logs to track access and modifications to the bucket.

References:

Google Cloud: Uniform bucket-level access

Managing access with IAM