菜单
Implement GCP Organization Policy constraints to enforce security guardrails across the entire resource hierarchy, restricting risky configurations and ensuring compliance at organization, folder, and project levels.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/xalgord/xalgorix --skill implementing-gcp-organization-policy-constraints命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
基于 SOC 职业分类
正在显示 SKILL.md
| name | implementing-gcp-organization-policy-constraints |
| description | Implement GCP Organization Policy constraints to enforce security guardrails across the entire resource hierarchy, restricting risky configurations and ensuring compliance at organization, folder, and project levels. |
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["gcp","organization-policy","constraints","governance","compliance","cloud-security","resource-manager"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] |
The GCP Organization Policy Service provides centralized and programmatic control over cloud resources. Organization policies configure constraints that restrict one or more Google Cloud services, enforced at organization, folder, or project levels. They improve security by blocking external IPs, requiring encryption, and minimizing unauthorized access. Changes can take up to 15 minutes to propagate.
dryRunSpec: true monitors and logs would-be violations but never blocks them. Confirm the live (enforced) spec exists, not just the dry-run, with gcloud org-policies describe <constraint> --organization=ORG_ID --effective.inheritFromParent: false or a reset/allValues: ALLOW rule negates the org guardrail. Audit effective policy at the leaf, not just the org node.allowedValues that omits a region your workloads use causes outages; allValues: ALLOW on a deny-intended constraint makes it a no-op. Validate against gcp.resourceLocations value groups (in:us-locations).enforced: false: e.g. iam.disableServiceAccountKeyCreation present but disabled still allows key creation.gcloud org-policies describe constraints/compute.vmExternalIpAccess --organization=ORG_ID --effective
gcloud org-policies list --project=PROJECT_ID # spot child overrides
gcloud asset search-all-resources --scope=organizations/ORG_ID \
--query="policy:constraints/compute.vmExternalIpAccess" # find violating resources
gcloud CLI configured and authenticatedroles/orgpolicy.policyAdmin)Policies inherit from the lowest ancestor with an enforced policy. If no ancestor has a policy, Google's managed default behavior applies.
# Deny external IP addresses on all VMs
gcloud resource-manager org-policies set-policy \
--organization=ORGANIZATION_ID \
policy.yaml
policy.yaml:
constraint: constraints/compute.vmExternalIpAccess
listPolicy:
allValues: DENY
gcloud org-policies set-policy \
--organization=ORGANIZATION_ID \
location-policy.yaml
location-policy.yaml:
constraint: constraints/gcp.resourceLocations
listPolicy:
allowedValues:
- "in:us-locations"
- "in:eu-locations"
constraint: constraints/iam.automaticIamGrantsForDefaultServiceAccounts
booleanPolicy:
enforced: true
constraint: constraints/compute.requireOsLogin
booleanPolicy:
enforced: true
constraint: constraints/compute.disableSerialPortAccess
booleanPolicy:
enforced: true
constraint: constraints/storage.uniformBucketLevelAccess
booleanPolicy:
enforced: true
constraint: constraints/sql.restrictPublicIp
booleanPolicy:
enforced: true
constraint: constraints/iam.disableServiceAccountKeyCreation
booleanPolicy:
enforced: true
resource "google_organization_policy" "restrict_vm_external_ip" {
org_id = var.org_id
constraint = "constraints/compute.vmExternalIpAccess"
list_policy {
deny {
all = true
}
}
}
resource "google_organization_policy" "restrict_locations" {
org_id = var.org_id
constraint = "constraints/gcp.resourceLocations"
list_policy {
allow {
values = ["in:us-locations", "in:eu-locations"]
}
}
}
resource "google_organization_policy" "require_os_login" {
org_id = var.org_id
constraint = "constraints/compute.requireOsLogin"
boolean_policy {
enforced = true
}
}
resource "google_folder_organization_policy" "dev_folder_external_ip" {
folder = google_folder.dev.name
constraint = "constraints/compute.vmExternalIpAccess"
list_policy {
allow {
values = ["projects/dev-project/zones/us-central1-a/instances/bastion-host"]
}
}
}
Use Policy Intelligence tools to test changes before enforcement:
# Create a dry-run policy to monitor impact
gcloud org-policies set-policy \
--organization=ORGANIZATION_ID \
dry-run-policy.yaml
dry-run-policy.yaml:
constraint: constraints/compute.vmExternalIpAccess
listPolicy:
allValues: DENY
dryRunSpec: true
# Check violations against dry-run policy
gcloud org-policies list-custom-constraints \
--organization=ORGANIZATION_ID
# custom-constraint.yaml
name: organizations/ORGANIZATION_ID/customConstraints/custom.disableGKEAutoUpgrade
resourceTypes:
- container.googleapis.com/NodePool
methodTypes:
- CREATE
- UPDATE
condition: "resource.management.autoUpgrade == true"
actionType: DENY
displayName: Deny GKE auto-upgrade on node pools
description: Prevents enabling auto-upgrade on GKE node pools for controlled upgrades
gcloud org-policies set-custom-constraint custom-constraint.yaml
gcloud org-policies list --organization=ORGANIZATION_ID
gcloud org-policies describe constraints/compute.vmExternalIpAccess \
--organization=ORGANIZATION_ID
gcloud asset search-all-resources \
--scope=organizations/ORGANIZATION_ID \
--query="policy:constraints/compute.vmExternalIpAccess"
| Constraint | Type | Scope | Purpose |
|---|---|---|---|
| compute.vmExternalIpAccess | List/Deny | Org | Prevent public VM IPs |
| gcp.resourceLocations | List/Allow | Org | Restrict to approved regions |
| iam.disableServiceAccountKeyCreation | Boolean | Org | Force Workload Identity |
| compute.requireOsLogin | Boolean | Org | Mandate OS Login for SSH |
| storage.uniformBucketLevelAccess | Boolean | Org | Enforce uniform bucket access |
| sql.restrictPublicIp | Boolean | Org | No public Cloud SQL |
| compute.disableSerialPortAccess | Boolean | Org | Disable serial port |
| compute.disableNestedVirtualization | Boolean | Org | No nested VMs |