I have been trying to review carefully GCP documentation related to IAM policies and I am kind of confused regarding when a child policy can overwrite a parent policy. In below links in the Best Practices section, it i said: https://cloud.google.com/iam/docs/resource-hierarchy-access-control "Remember that a policy set on a child resource cannot restrict access granted on its parent. Check the policy granted on every resource and understand the hierarchical inheritance." But , in below link: https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy In the example provided, it is said: "Resource 2 defines a custom policy that sets inheritFromParent to TRUE and denies green circle. Deny values always take precedence during policy reconciliation. The policy from the Organization Node is inherited and merged with the custom policy, and the effective policy evaluates to allow only red square."
So, I am kind of a bit confused. Thoughts with this? what is what I may be missing?
Thanks so much in advance!! Regards.