Restrict the Creation of Cloud Resources to Specific Locations
More Info:
Ensure that “Google Cloud Platform - Resource Location Restriction” constraint policy is enforced for your GCP organizations.Risk Level
MediumAddress
Operational Maturity, Reliability, SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To restrict the creation of cloud resources to specific locations in GCP, you can follow these steps:
- Open the GCP console and navigate to the IAM & admin page.
- Select the project for which you want to restrict the creation of cloud resources.
- Click on the “Edit” button next to the “Service Accounts” section.
- Locate the service account that you want to restrict and click on the “Edit” button next to it.
- Scroll down to the “Service Account Permissions” section and click on the “Add Another” button.
- In the “Add Permission” dialog box, select “Cloud Resource Manager API” from the “Select a service” dropdown menu.
- In the “Select a role” dropdown menu, select “Cloud Resource Manager Editor” or “Cloud Resource Manager Viewer” depending on the level of access you want to grant.
- In the “Select a resource” dropdown menu, select “All resources in the selected project”.
- In the “Condition” section, click on the “Add Condition” button.
- In the “Add Condition” dialog box, select “Location” from the “Attribute” dropdown menu.
- In the “Operator” dropdown menu, select “is not one of”.
- In the “Value” field, enter the list of allowed locations separated by commas (e.g. us-central1, us-west1, europe-west1).
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To restrict the creation of cloud resources to specific locations in GCP, you can follow these steps using the GCP CLI:
- Open the GCP Cloud Shell by clicking on the icon in the top right-hand corner of the GCP console.
-
In the Cloud Shell, enter the following command to list the current organization policy constraints:
- Identify the policy constraint that needs to be updated to restrict the creation of cloud resources to specific locations.
-
Enter the following command to get the details of the policy constraint:
Replace
[CONSTRAINT]with the name of the policy constraint. - Determine the locations to which you want to restrict the creation of cloud resources.
-
Enter the following command to update the policy constraint to restrict the creation of cloud resources to the specified locations:
Replace
[CONSTRAINT]with the name of the policy constraint and[LOCATION1],[LOCATION2], etc. with the locations to which you want to restrict the creation of cloud resources. -
Verify that the policy constraint has been updated by entering the following command:
Replace
[CONSTRAINT]with the name of the policy constraint.
Using Python
Using Python
To restrict the creation of cloud resources to specific locations in GCP using Python, you can follow these steps:
-
First, you need to set up a GCP project and install the necessary Python libraries. You can use the
google-cloud-resource-managerlibrary to manage GCP resources. -
Next, you need to create a configuration file that specifies the allowed locations where resources can be created. For example, you can create a
config.yamlfile that looks like this:
- In your Python script, you can read the configuration file and use it to validate the location of the resources being created. Here’s an example code snippet:
- You can repeat this validation for other types of resources as well, such as GCS buckets or Cloud Functions.