신규 고객인 경우 Google Cloud는 다음 시나리오에서 도메인의 조직 리소스를 자동으로 프로비저닝합니다.
도메인의 사용자가 처음으로 로그인하는 경우
사용자가 조직 리소스가 연결되지 않은 결제 계정을 만드는 경우
무제한 액세스가 특징인 이 조직 리소스의 기본 구성으로 인해 인프라가 보안 침해에 노출될 가능성이 있습니다. 예를 들어 기본 서비스 계정 키 생성은 시스템을 잠재적 침해에 노출시키는 심각한 취약점입니다.
기본 보안 조직 정책을 시행하면 취약한 보안 상태는 조직 리소스 생성 시 적용되는 조직 정책 번들로 해결됩니다. 이러한 적용의 예시로는 서비스 계정 키 생성 중지와 서비스 계정 키 업로드 중지가 있습니다.
기존 사용자가 조직을 만들면 새 조직 리소스의 보안 상황은 기존 조직 리소스와 다를 수 있습니다.
보안 강화를 기본으로 설정한 조직 정책은 2024년 5월 3일 이후에 생성된 모든 조직에 적용됩니다. 2024년 2월과 2024년 4월 사이에 생성된 일부 조직에도 이러한 기본 정책 적용이 설정되어 있을 수 있습니다. 조직에 적용된 조직 정책을 보려면 조직 정책 보기를 참조하세요.
관리자로서 이러한 조직 정책 시행이 자동으로 적용되는 시나리오는 다음과 같습니다.
Google Workspace 또는 Cloud ID 계정: Google Workspace 또는 Cloud ID 계정이 있으면 도메인과 연결된 조직 리소스가 생성됩니다. 보안 강화를 기본으로 설정한 조직 정책은 조직 리소스에 자동으로 적용됩니다.
결제 계정 생성: 생성된 결제 계정이 조직 리소스와 연결되지 않으면 조직 리소스가 자동으로 생성됩니다. 보안 강화를 기본으로 설정한 조직 정책은 조직 리소스에 적용됩니다. 이 시나리오는 Google Cloud 콘솔과 gcloud CLI 모두에서 작동합니다.
필수 권한
Identity and Access Management 역할 roles/orgpolicy.policyAdmin이 있는 관리자는 조직 정책을 관리할 수 있습니다. 조직 정책을 변경하거나 재정의하려면 조직 정책 관리자여야 합니다.
역할을 부여하려면 다음 명령어를 실행하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Managing secure-by-default organization resources\n\nIf you are a new customer, Google Cloud automatically provisions an\norganization resource for your domain in the following scenarios:\n\n- A user from your domain logs in for the first time.\n- A user creates a billing account that does not have an associated organization resource.\n\nThis organization resource's default configuration, characterized by unrestricted\naccess, can make the infrastructure susceptible to security breaches. For\nexample, default service account key creation is a critical vulnerability\nexposing systems to potential breaches.\n\nWith the secure-by-default organization policy enforcements, insecure\npostures are addressed with a bundle of organization policies that are enforced\nat the time of creation of an organization resource. Examples of these enforcements\ninclude disabling service account key creation and disabling service account key upload.\n\nWhen an existing user creates an organization, the security posture for the\nnew organization resource might be different from the existing organization resources.\nSecure-by-default organization policies are enforced for all organizations\ncreated on or after May 3, 2024. Some organizations created between February 2024\nand April 2024 might also have these default policy enforcements set. To view organization\npolicies applied to your organization, see\n[Viewing organization policies](/resource-manager/docs/organization-policy/creating-managing-policies#viewing_organization_policies).\n\nAs an administrator, following are the scenarios where these organization policy\nenforcements are applied automatically:\n\n- **Google Workspace or Cloud Identity account**: When you have a Google Workspace or Cloud Identity account, an organization resource is created that is associated with your domain. The secure-by-default organization policies are enforced automatically on the organization resource.\n- **Billing account creation**: If the billing account you create is not associated with an organization resource, then an organization resource is automatically created. The secure-by-default organization policies are enforced on the organization resource. This scenario works on both the Google Cloud console and gcloud CLI.\n\nRequired permissions\n--------------------\n\nThe Identity and Access Management role\n[`roles/orgpolicy.policyAdmin`](/iam/docs/understanding-roles#organization-policy-roles) enables\nan administrator to manage organization policies. You must be an organization\npolicy administrator to change or override organization policies.\nTo grant the role, run the following command: \n\n gcloud organizations add-iam-policy-binding \u003cvar translate=\"no\"\u003eORGANIZATION\u003c/var\u003e --member=\u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e --role=\u003cvar translate=\"no\"\u003eROLE\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eORGANIZATION\u003c/var\u003e: Unique identifier of your organization.\n- \u003cvar translate=\"no\"\u003ePRINCIPAL\u003c/var\u003e: The principal to add the binding for. This should be of the form `user|group|serviceAccount:email` or `domain:domain`. For example, `user:222larabrown@gmail.com`.\n- \u003cvar translate=\"no\"\u003eROLE\u003c/var\u003e: Role to grant to the principal. Use the complete path of a predefined role. In this case, it should be `roles/orgpolicy.policyAdmin`.\n\nOrganization policies enforced on organization resources\n--------------------------------------------------------\n\nThe following table lists the organization policy constraints that are\nautomatically enforced when you create an organization resource.\n\n| **Note:** For some organizations created after August 15, 2024, the `constraints/compute.restrictProtocolForwardingCreationForTypes` organization policy constraint might already be applied.\n\nManage enforcement of organization policies\n-------------------------------------------\n\nYou can manage the enforcement of organization policies in the following ways:\n\n### List organization policies\n\nTo check whether the secure-by-default organization policies are enforced on your organization,\nuse the following command: \n\n gcloud resource-manager org-policies list --organization=\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e\n\nReplace \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e with the unique identifier of your organization.\n\n### Disable organization policies\n\nTo disable or delete an organization policy, run the following command: \n\n gcloud org-policies delete \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e --organization=\u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e is the name of the organization policy constraint you want to delete. An example is `iam.allowedPolicyMemberDomains`.\n- \u003cvar translate=\"no\"\u003eORGANIZATION_ID\u003c/var\u003e is the unique identifier of your organization.\n\n### Add or update values for an organization policy\n\nTo add or update values for an organization policy, you need to store the values in a YAML file.\nAn example of what the contents of this file can look like: \n\n {\n \"name\": \"organizations/ORG_ID/policies/\u003cvar translate=\"no\"\u003eCONSTRAINT_NAME\u003c/var\u003e\",\n \"spec\": {\n \"rules\": [\n {\n \"values\": {\n \"allowedValues\": [\"VALUE_A\"]\n }\n }\n ]\n }\n }\n\nTo add or update these values listed in the YAML file, run the following command: \n\n gcloud org-policies set-policy \u003cvar translate=\"no\"\u003ePOLICY_FILE\u003c/var\u003e\n\nReplace \u003cvar translate=\"no\"\u003ePOLICY_FILE\u003c/var\u003e with the path to the YAML file that contains the\nvalues of the organization policy."]]
