Ensure that the locations where location-based cloud resources can be created within your GCP organization are defined using the "Google Cloud Platform - Resource Location Restriction" organization policy. This constraint policy helps you achieve regulatory compliance by explicitly defining the locations allowed to deploy Google Cloud resources for your organization. You can specify multi-regions such as "asia" and "europe" and individual regions such as "us-east1" or "europe-west2" as allowed locations. You can specify value groups, collections of locations that are curated by Google Cloud to provide a simple way to define your resource locations. To use value groups with the "Google Cloud Platform - Resource Location Restriction" policy, prefix your entries with the string in: followed by the value group. The list of allowed locations must be configured in the conformity rule settings, on the Trend Micro Cloud One™ – Conformity account console.
With "Google Cloud Platform - Resource Location Restriction" constraint policy you can limit the physical location of a new Google Cloud resource within your GCP organization. This policy enables you to define the allowed locations where the cloud resources for supported services in your hierarchy can be created in order to comply with your organization`s internal regulations. After you configure the allowed resource locations, this limitation will apply only to newly-created GCP resources. The resources that you created before setting the resource locations constraint will continue to exist and perform their function as expected.
Note: To avoid breaking existing cloud infrastructure, you should test the "Google Cloud Platform - Resource Location Restriction" constraint policy on non-production projects and folders within your organization, then configure and apply the policy gradually.
Audit
To determine if the location-based restriction is enabled within your GCP organizations, perform the following actions:
Remediation / Resolution
To implement the restriction of creating Google Cloud resources within specific locations, at the GCP organization level, enable and configure the “Google Cloud Platform - Resource Location Restriction” organization policy by performing the following actions:
References
- Google Cloud Platform (GCP) Documentation
- Resource Manager
- Regions and zones
- Organization policy constraints
- Creating and managing organization policies
- Restricting Resource Locations
- Resource locations supported services
- GCP Command Line Interface (CLI) Documentation
- gcloud organizations list
- gcloud alpha resource-manager org-policies describe
- gcloud beta resource-manager org-policies set-policy
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Restrict the Creation of Cloud Resources to Specific Locations
Risk Level: Medium