implementing-gcp-organization-policy-constraints skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource locations, default service accounts, and service account keys, plus dry-run testing of policy impact before enforcement. Use when enforcing security guardrails across an org's resource hierarchy, or hardening GCP config at the org, folder, or project level. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/implementing-gcp-organization-policy-constraints/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-gcp-organization-policy-constraints, or copy the skill folder into ~/.claude/skills/implementing-gcp-organization-policy-constraints/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-gcp-organization-policy-constraints/SKILL.md

SKILL.md (verbatim)

name: implementing-gcp-organization-policy-constraints
description: Implements GCP Organization Policy constraints via gcloud and Terraform, such as restricting external IPs, resource locations, default service accounts, and service account keys, plus dry-run testing of policy impact before enforcement. Use when enforcing security guardrails across an org's resource hierarchy, or hardening GCP config at the org, folder, or project level.
domain: cybersecurity
subdomain: cloud-security
tags:
- gcp
- organization-policy
- constraints
- governance
- compliance
- cloud-security
- resource-manager
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- PR.IR-01
- ID.AM-08
- GV.SC-06
- DE.CM-01
mitre_attack:
- T1078.004
- T1530
- T1537
- T1580

Implementing GCP Organization Policy Constraints

Overview

The GCP Organization Policy Service provides centralized and programmatic control over cloud resources. Organization policies configure constraints that restrict one or more Google Cloud services, enforced at organization, folder, or project levels. They improve security by blocking external IPs, requiring encryption, and minimizing unauthorized access. Changes can take up to 15 minutes to propagate.

When to Use

  • When deploying or configuring implementing gcp organization policy constraints capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • GCP Organization with Organization Administrator role
  • gcloud CLI configured and authenticated
  • Terraform or gcloud for policy management
  • Organization Policy Administrator IAM role (roles/orgpolicy.policyAdmin)

Core Concepts

Constraint Types

  1. List Constraints: Allow or deny specific values (e.g., allowed regions)
  2. Boolean Constraints: Enable or disable a capability (e.g., disable serial port access)
  3. Custom Constraints: User-defined rules targeting specific resource fields (Preview)

Policy Inheritance

Policies inherit from the lowest ancestor with an enforced policy. If no ancestor has a policy, Google's managed default behavior applies.

Essential Security Constraints

Restrict VM External IP Addresses

# Deny external IP addresses on all VMs
gcloud resource-manager org-policies set-policy \
  --organization=ORGANIZATION_ID \
  policy.yaml

policy.yaml:

constraint: constraints/compute.vmExternalIpAccess
listPolicy:
  allValues: DENY

Restrict Resource Locations

gcloud org-policies set-policy \
  --organization=ORGANIZATION_ID \
  location-policy.yaml

location-policy.yaml:

constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - "in:us-locations"
    - "in:eu-locations"

Disable Default Service Account Creation

constraint: constraints/iam.automaticIamGrantsForDefaultServiceAccounts
booleanPolicy:
  enforced: true

Require OS Login for SSH

constraint: constraints/compute.requireOsLogin
booleanPolicy:
  enforced: true

Disable Serial Port Access

constraint: constraints/compute.disableSerialPortAccess
booleanPolicy:
  enforced: true

Enforce Uniform Bucket-Level Access

constraint: constraints/storage.uniformBucketLevelAccess
booleanPolicy:
  enforced: true

Restrict Public IP on Cloud SQL

constraint: constraints/sql.restrictPublicIp
booleanPolicy:
  enforced: true

Disable Service Account Key Creation

constraint: constraints/iam.disableServiceAccountKeyCreation
booleanPolicy:
  enforced: true

Terraform Implementation

resource "google_organization_policy" "restrict_vm_external_ip" {
  org_id     = var.org_id
  constraint = "constraints/compute.vmExternalIpAccess"

  list_policy {
    deny {
      all = true
    }
  }
}

resource "google_organization_policy" "restrict_locations" {
  org_id     = var.org_id
  constraint = "constraints/gcp.resourceLocations"

  list_policy {
    allow {
      values = ["in:us-locations", "in:eu-locations"]
    }
  }
}

resource "google_organization_policy" "require_os_login" {
  org_id     = var.org_id
  constraint = "constraints/compute.requireOsLogin"

  boolean_policy {
    enforced = true
  }
}

resource "google_folder_organization_policy" "dev_folder_external_ip" {
  folder     = google_folder.dev.name
  constraint = "constraints/compute.vmExternalIpAccess"

  list_policy {
    allow {
      values = ["projects/dev-project/zones/us-central1-a/instances/bastion-host"]
    }
  }
}

Dry-Run Testing

Use Policy Intelligence tools to test changes before enforcement:

# Create a dry-run policy to monitor impact
gcloud org-policies set-policy \
  --organization=ORGANIZATION_ID \
  dry-run-policy.yaml

dry-run-policy.yaml:

constraint: constraints/compute.vmExternalIpAccess
listPolicy:
  allValues: DENY
dryRunSpec: true

# Check violations against dry-run policy
gcloud org-policies list-custom-constraints \
  --organization=ORGANIZATION_ID

Custom Constraints

# custom-constraint.yaml
name: organizations/ORGANIZATION_ID/customConstraints/custom.disableGKEAutoUpgrade
resourceTypes:
  - container.googleapis.com/NodePool
methodTypes:
  - CREATE
  - UPDATE
condition: "resource.management.autoUpgrade == true"
actionType: DENY
displayName: Deny GKE auto-upgrade on node pools
description: Prevents enabling auto-upgrade on GKE node pools for controlled upgrades

gcloud org-policies set-custom-constraint custom-constraint.yaml

Monitoring and Compliance

List active policies

gcloud org-policies list --organization=ORGANIZATION_ID

Describe a specific policy

gcloud org-policies describe constraints/compute.vmExternalIpAccess \
  --organization=ORGANIZATION_ID

Audit policy violations with Cloud Asset Inventory

gcloud asset search-all-resources \
  --scope=organizations/ORGANIZATION_ID \
  --query="policy:constraints/compute.vmExternalIpAccess"
Constraint Type Scope Purpose
compute.vmExternalIpAccess List/Deny Org Prevent public VM IPs
gcp.resourceLocations List/Allow Org Restrict to approved regions
iam.disableServiceAccountKeyCreation Boolean Org Force Workload Identity
compute.requireOsLogin Boolean Org Mandate OS Login for SSH
storage.uniformBucketLevelAccess Boolean Org Enforce uniform bucket access
sql.restrictPublicIp Boolean Org No public Cloud SQL
compute.disableSerialPortAccess Boolean Org Disable serial port
compute.disableNestedVirtualization Boolean Org No nested VMs

References

Other files in this skill

assets/template.md (verbatim)

GCP Organization Policy Implementation Template

Organization Details

Field Value
Organization ID
Organization Name
Implementation Date
Policy Administrator

Baseline Constraints Checklist

Constraint Scope Status Exceptions
compute.vmExternalIpAccess Org [ ] Enforced
compute.requireOsLogin Org [ ] Enforced
compute.disableSerialPortAccess Org [ ] Enforced
iam.disableServiceAccountKeyCreation Org [ ] Enforced
storage.uniformBucketLevelAccess Org [ ] Enforced
sql.restrictPublicIp Org [ ] Enforced
gcp.resourceLocations Org [ ] Enforced
compute.disableNestedVirtualization Org [ ] Enforced

Exception Requests

Constraint Requesting Team Project/Folder Justification Approved By Expiry

Dry-Run Results

Constraint Violations Found Affected Resources Remediation Plan

references/api-reference.md (verbatim)

API Reference: Implementing GCP Organization Policy Constraints

gcloud CLI Commands

# List all org policies
gcloud org-policies list --organization=ORG_ID

# Describe specific constraint
gcloud org-policies describe constraints/compute.vmExternalIpAccess --organization=ORG_ID

# Set policy from YAML
gcloud resource-manager org-policies set-policy policy.yaml --organization=ORG_ID

# Set custom constraint
gcloud org-policies set-custom-constraint custom-constraint.yaml

# Check effective policy on project
gcloud org-policies list --project=PROJECT_ID

Baseline Security Constraints

Constraint Type Purpose
compute.vmExternalIpAccess List/Deny Block public VM IPs
compute.requireOsLogin Boolean Mandate OS Login for SSH
compute.disableSerialPortAccess Boolean Disable serial port
storage.uniformBucketLevelAccess Boolean Uniform bucket ACLs
sql.restrictPublicIp Boolean No public Cloud SQL
iam.disableServiceAccountKeyCreation Boolean Force Workload Identity
gcp.resourceLocations List/Allow Restrict to approved regions

Policy YAML Formats

Boolean Policy

constraint: constraints/compute.requireOsLogin
booleanPolicy:
  enforced: true

List Policy (Deny All)

constraint: constraints/compute.vmExternalIpAccess
listPolicy:
  allValues: DENY

List Policy (Allow Specific)

constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - "in:us-locations"
    - "in:eu-locations"

Terraform Resource

resource "google_organization_policy" "example" {
  org_id     = var.org_id
  constraint = "constraints/compute.requireOsLogin"
  boolean_policy { enforced = true }
}

References

references/standards.md (verbatim)

Standards and References - GCP Organization Policy Constraints

CIS GCP Foundations Benchmark v3.0

Section Control Constraint
1.4 Ensure user-managed service account keys are rotated within 90 days iam.disableServiceAccountKeyCreation
3.10 Ensure VPC Flow Logs are enabled N/A (use custom constraint)
4.4 Ensure OS Login is enabled for a project compute.requireOsLogin
4.5 Ensure serial port access is disabled compute.disableSerialPortAccess
6.2 Ensure Cloud SQL instances are not publicly accessible sql.restrictPublicIp
5.1 Ensure uniform bucket-level access is enabled storage.uniformBucketLevelAccess

NIST 800-53 Controls Mapping

  • AC-3: Access Enforcement
  • AC-6: Least Privilege
  • CM-7: Least Functionality
  • SC-7: Boundary Protection
  • SC-12: Cryptographic Key Establishment

Google Cloud Security Best Practices

  • Principle of least privilege for organization policies
  • Hierarchical policy inheritance model
  • Dry-run testing before enforcement
  • Separate exception management from baseline policies

references/workflows.md (verbatim)

Workflows - GCP Organization Policy Constraints

Implementation Workflow

1. Inventory Phase
   ├── List all existing organization policies
   ├── Identify current resource configurations
   ├── Map compliance requirements to constraints
   └── Document exceptions needed per team/project

2. Design Phase
   ├── Select constraints for baseline enforcement
   ├── Define exception policies for specific folders/projects
   ├── Plan hierarchy (Org → Folder → Project overrides)
   └── Document policy inheritance chain

3. Testing Phase
   ├── Deploy constraints in dry-run mode
   ├── Monitor violation logs for 2-4 weeks
   ├── Identify legitimate use cases requiring exceptions
   └── Refine policies based on dry-run results

4. Enforcement Phase
   ├── Convert dry-run policies to enforced mode
   ├── Apply exceptions at appropriate hierarchy level
   ├── Communicate changes to engineering teams
   └── Monitor for new violations

5. Ongoing Governance
   ├── Review policies quarterly
   ├── Audit exception requests
   ├── Update constraints for new GCP services
   └── Integrate with change management process

Exception Management Workflow

1. Request → Developer requests exception for specific constraint
2. Review → Security team evaluates risk and business justification
3. Approve → Exception approved with scope (project/folder) and duration
4. Implement → Policy override applied at lowest necessary scope
5. Audit → Regular review of active exceptions
6. Expire → Time-bound exceptions automatically revert

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.