Lion Cipher Lab
Design Google Cloud Organization Policy guardrails - and evaluate their inheritance offline before you ship them
- Cloud Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
On Google Cloud, the strongest controls a security team owns are not IAM roles. They are organization policies: guardrails set once at the top of the company's resource tree that say what may exist anywhere below it. No service account keys. No outsiders in IAM. No attaching to the wrong shared network. Set well, one policy protects thousands of projects that nobody has created yet. Set carelessly, the guardrail looks enforced on the dashboard while a single project-level exception quietly turns it off. The rules that decide this are short but surprising. A reset does not mean 'inherit…
What you'll learn
- Explaining the difference between Organization Policy (what configuration may exist) and IAM (who may act), and where IAM deny policies and VPC Service Controls fit
- Computing the effective policy for any project from the documented hierarchy rules: closest-wins for boolean constraints, merge-with-parent for list constraints, deny precedence, reset to the constraint default
- Writing policies in the v2 shape (spec.rules, inheritFromParent, reset, dryRunSpec) and linting them for shapes the API rejects
- Spotting the three classic exception mistakes: a reset that reopens a hole, a Replace that locks out your own domain, and an allowedValues that a parent's deny silently cancels
- Turning a per-project exception into one reviewed, tag-scoped conditional rule
- Rehearsing a rollout with an inventory scan and a dry-run audit log filter, and knowing which constraints are retroactive
Steps in this lab
- What an organization policy is, and why it is not IAM
- Set up a folder and check Python (5 minutes)
- The rules you are about to implement, straight from the docs
- Write the evaluator: hierarchy, catalog, evaluation, linter, fixtures
- Run the BEFORE matrix and find the holes
- Measure the wrong mental model: 3 of 48 cells
- Lint before you ship: the 6 shapes the API refuses
- AFTER: exceptions as reviewed code, scoped by a tag
- Rehearse a rollout: inventory, dry run, then enforce
- Retroactive or not: read the constraint entry every time
- Judgment: org policy, IAM deny policies, or VPC Service Controls?
- Where this evaluator stops, and how a pro does it better