이 예시에서는 조직 A의 이그레스 프록시 관리자와 Google Cloud 관리자가 협력하여 직원들이 Cloud Storage 리소스에 대한 읽기 요청을 제외하고 해당 Google Cloud 조직의 리소스에만 액세스하도록 제한하는 것을 보여줍니다.
관리자는 직원들이 Cloud Storage를 사용하여 정적 콘텐츠를 호스팅하는 외부 웹사이트에 액세스할 수 있도록 조직 액세스 제한 시행에서 Cloud Storage 리소스에 대한 읽기 요청을 생략해야 할 수 있습니다. 관리자는 cloudStorageReadAllowed 옵션을 사용하여 Cloud Storage 리소스에 대한 읽기 요청을 허용합니다.
조직에만 액세스를 제한하고 Cloud Storage 리소스에 대한 읽기 요청을 허용하려면 다음을 수행합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Examples of organization restrictions\n\nThis page describes several common examples of how to use organization restrictions.\n\nRestrict access only to your organization\n-----------------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization A engage together to restrict employees to only access resources in their\nGoogle Cloud organization.\n\nTo restrict access only to your organization, do the following:\n\n1. As a Google Cloud administrator, to get the Google Cloud organization ID of\n Organization A, use the [`gcloud organizations list` command](/sdk/gcloud/reference/organizations/list):\n\n gcloud organizations list\n\n The following is the example output: \n\n ```\n DISPLAY_NAME: Organization A\n ID: 123456789\n DIRECTORY_CUSTOMER_ID: a1b2c3d4\n ```\n2. As an egress proxy administrator, after you get the organization ID from the Google Cloud\n administrator, compose the JSON representation for the header value in the following format:\n\n {\n \"resources\": [\"organizations/123456789\"],\n \"options\": \"strict\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted in all of the requests originating from the managed devices\n in Organization A:\n\n X-Goog-Allowed-Resources: ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\nRestrict access to your organization and allow read requests to Cloud Storage resources\n---------------------------------------------------------------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization A engage together to restrict employees to only access resources in their\nGoogle Cloud organization, except for read requests to Cloud Storage resources.\nAdministrators might want to omit read requests to Cloud Storage resources from\norganization restrictions enforcement to ensure that their employees can access\nexternal websites that use Cloud Storage to host static content. The administrator\nuses the `cloudStorageReadAllowed` option to allow read requests to Cloud Storage resources.\n\nTo restrict access only to your organization and allow read requests to Cloud Storage\nresources, do the following:\n\n1. As a Google Cloud administrator, to get the Google Cloud organization ID of\n Organization A, use the [`gcloud organizations list` command](/sdk/gcloud/reference/organizations/list):\n\n gcloud organizations list\n\n The following is the example output: \n\n ```\n DISPLAY_NAME: Organization A\n ID: 123456789\n DIRECTORY_CUSTOMER_ID: a1b2c3d4\n ```\n2. As an egress proxy administrator, after you get the organization ID from the Google Cloud\n administrator, compose the JSON representation for the header value in the following format:\n\n {\n \"resources\": [\"organizations/123456789\"],\n \"options\": \"cloudStorageReadAllowed\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogICJyZXNvdXJjZXMiOiBbIm9yZ2FuaXphdGlvbnMvMTIzNDU2Nzg5Il0sCiAgIm9wdGlvbnMiOiAiY2xvdWRTdG9yYWdlUmVhZEFsbG93ZCIKfQo=l\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted in all of the requests originating from the managed devices\n in Organization A:\n\n X-Goog-Allowed-Resources: ewogICJyZXNvdXJjZXMiOiBbIm9yZ2FuaXphdGlvbnMvMTIzNDU2Nzg5Il0sCiAgIm9wdGlvbnMiOiAiY2xvdWRTdG9yYWdlUmVhZEFsbG93ZCIKfQo=l\n\n The employees of Organization A now have access to their Google Cloud organization\n and read access to Cloud Storage resources.\n\nAllow employees access to a vendor Google Cloud organization\n------------------------------------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization B engage together to allow employees to access a vendor Google Cloud organization\nin addition to their existing Google Cloud organization.\n\nTo restrict employee access only to your organization and the vendor organization, do the following:\n\n1. As a Google Cloud administrator, engage with the vendor to get the Google Cloud\n organization ID of the vendor organization.\n\n2. As an egress proxy administrator, to include the vendor organization ID in addition\n to the existing organization ID, you must update the JSON representation for\n the header value. After you get the vendor organization ID from the Google Cloud\n administrator, update the header value in the following format:\n\n {\n \"resources\": [\"organizations/1234\", \"organizations/3456\"],\n \"options\": \"strict\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiLCAib3JnYW5pemF0aW9ucy8xMDExMTIxMzE0Il0sCiAib3B0aW9ucyI6ICJzdHJpY3QiCn0K\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted in all of the requests originating from the managed devices\n in Organization B:\n\n X-Goog-Allowed-Resources: ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiLCAib3JnYW5pemF0aW9ucy8xMDExMTIxMzE0Il0sCiAib3B0aW9ucyI6ICJzdHJpY3QiCn0K\n\n The employees of Organization B now have access to both the vendor and their Google Cloud organizations.\n\nRestrict access only for uploads\n--------------------------------\n\nIn this example, the Google Cloud administrator and egress proxy administrator of\nOrganization C engage together to restrict upload access of employees only to resources in the\nGoogle Cloud organization.\n\nTo restrict upload access only to your organization, do the following:\n\n1. As a Google Cloud administrator, to get the Google Cloud organization ID of\n Organization C, use the [`gcloud organizations list` command](/sdk/gcloud/reference/organizations/list):\n\n gcloud organizations list\n\n The following is the example output: \n\n ```\n DISPLAY_NAME: Organization C\n ID: 123456789\n DIRECTORY_CUSTOMER_ID: a1b2c3d4\n ```\n2. As an egress proxy administrator, after you get the organization ID from the Google Cloud\n administrator, compose the JSON representation for the header value in the following format:\n\n {\n \"resources\": [\"organizations/123456789\"],\n \"options\": \"strict\"\n }\n\n3. As an egress proxy administrator, encode the value for the request header by following the [RFC 4648 Section 5 specifications](https://datatracker.ietf.org/doc/html/rfc4648#section-5).\n\n For example, if the JSON representation for the header value is stored in the\n `authorized_orgs.json` file, to encode the file, run the following\n [basenc](https://man7.org/linux/man-pages/man1/basenc.1.html) command: \n\n $ cat authorized_orgs.json | basenc --base64url -w0\n ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\n4. As an egress proxy administrator, configure the egress proxy such that the following\n request header is inserted only for requests with PUT, POST, and PATCH methods\n originating from the managed devices in Organization C:\n\n X-Goog-Allowed-Resources: ewogInJlc291cmNlcyI6IFsib3JnYW5pemF0aW9ucy8xMjM0NTY3ODkiXSwKICJvcHRpb25zIjogInN0cmljdCIKfQo\n\nWhat's next\n-----------\n\n- Learn about the [services supported by organization restrictions](/resource-manager/docs/organization-restrictions/supported-services)."]]
