Google Associate Cloud EngineerSetting up a cloud solution environmentHard
A company wants to establish a consistent naming convention for all new Google Cloud projects within their organization (e.g., `proj-[environment]-[department]-[purpose]`). They need to prevent users from creating projects that do not adhere to this convention. Which Google Cloud service can enforce this at the organization level?
- ACloud IAM with custom roles.
- BOrganization Policy Service with a custom constraint.
- CCloud Asset Inventory for auditing project names.
- DCloud Functions triggered by project creation events.
Show answer & explanationAnswer & explanation
Correct answer: B. Organization Policy Service with a custom constraint.
The Organization Policy Service, using custom constraints (Regex for project IDs), is the correct and most effective way to enforce naming conventions for new projects at the organization level. It *prevents* non-compliant projects from being created.
Why the other options are wrong
- A. IAM roles control *who* can create projects, not *what naming conventions* must be followed for those projects.
- C. Cloud Asset Inventory is for auditing existing resources, not for preventing their creation based on naming conventions.
- D. Cloud Functions would be reactive (triggered *after* creation) and would need to delete non-compliant projects, which is less efficient and more disruptive than prevention.
Organization Policy for Naming Conventions
The Organization Policy Service, leveraging custom constraints with regular expressions, is used to enforce naming conventions for Google Cloud project IDs and other resources, preventing the creation of non-compliant resources.
- Prevents creation of non-compliant resources.
- Uses custom constraints with regex patterns.
- Applied at the Organization, Folder, or Project level.
- Constraint ID example: `constraints/resourcemanager.allowedProjectIds`.
Memory trick: Organization Policies are the only way to constrain project names from the start.