0

I have been trying to review carefully GCP documentation related to IAM policies and I am kind of confused regarding when a child policy can overwrite a parent policy. In below links in the Best Practices section, it i said: https://cloud.google.com/iam/docs/resource-hierarchy-access-control "Remember that a policy set on a child resource cannot restrict access granted on its parent. Check the policy granted on every resource and understand the hierarchical inheritance." But , in below link: https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy In the example provided, it is said: "Resource 2 defines a custom policy that sets inheritFromParent to TRUE and denies green circle. Deny values always take precedence during policy reconciliation. The policy from the Organization Node is inherited and merged with the custom policy, and the effective policy evaluates to allow only red square."

So, I am kind of a bit confused. Thoughts with this? what is what I may be missing?

Thanks so much in advance!! Regards.

1 Answer 1

0

I noticed that you are trying to compare two different concepts, while the first document is explaining clearly about IAM Policies and how it applies the hierarchy, the second document is talking about Organization Policies and how constraints can help you to enforce your organization resources.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .