[GAVIN HARRISON, "LIVING FOR TODAY"]
SPEAKER: Identity and Access Management
focuses on the who of your cloud organization.
It lets an administrator authorize
who can take actions on specific resources
based on permissions and roles.
As the next line of defense, Organization Policy
lets administrators define the what-- i.e.
what resource configurations are allowed in their organization
independent of who or where the request comes from.
It ensures compliance and conformance
at a higher level than IAM by ensuring
that only secure and compliant resources are
used across the organization.
The Organization Policy Service gives you
centralized and programmatic control
over your organization's cloud resources.
As the Organization Policy administrator,
you will be able to configure security guardrails
across your entire resource hierarchy.
You can think about Organization Policy
within Google Cloud as its one-stop governance guardrail
system.
Security admins can use it to enforce
what types of resource configurations
are allowed in their environment.
This ensures your company stays within compliance boundaries
and adheres to your company's security policies.
Org policies can improve security
at the scale needed by today's cloud users.
This is particularly important as you scale your org
across thousands of projects, resources, and users,
and you don't want to slow down development due to compliance
or security requirements.
For example, you can centralize control of GCP resource
configurations to meet governance and security goals,
define and establish guardrails for your development teams
to stay within compliance boundaries,
and help project owners and their teams
move quickly without worry of breaking compliance.
Organization policies are made up
of guardrails or constraints that
allow you to set yourself up well for security
and compliance.
Think of the constraints as an intent or rule
set that defines what behaviors are controlled.
This rule set is then applied to a resource hierarchy node
as an organization policy, which implements the rules defined
in the constraint.
For instance, you can limit resource sharing
based on domain, limit the usage of Identity and Access
Management Service accounts, and restrict the physical location
of newly created resources.
There are many more constraints that
give you fine-grained control of your organization's resources.
For more information, see the list
of all Organization Policy Service constraints linked
in the description below.
In addition to the list of preconfigured constraints
that GCP offers, security admins can also
define custom constraints using Common Expression Language,
CEL, to create and manage resource restrictions tailored
to their specific use cases.
For more information, see the links in the description below.
When a Google Cloud resource acts or is
in a state that is counter to an organization policy
applicable to that resource, it is in violation.
Organization Policy Service will enforce constraints
and block resource actions, such as create or update resource,
that would result in these violations.
When resource actions conflict with enforced organization
policies, such actions will not be allowed
and will generate auditable logs for further analysis
and reporting.
You can review these logs' findings and plan
for remediation, letting you have business continuity
while hardening your services.
To set up your cloud organization's guardrails
to improve security and compliance on your systems,
you can start using the Organization Policy Service
today.
You can find out more details using our Overview page linked
in the description below.
Thanks for watching.
[GAVIN HARRISON, "LIVING FOR TODAY"]