Your Google Cloud environment has one organization node, one folder named "Apps", and several projects within that folder. The organizational node enforces the…

Question

Options

• AThe action succeeds because members from both organizations, terramearth.com or
• BThe action succeeds and the new member is successfully added to the project's Identity and
• CThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy
• DThe action fails because a constraints/iam.allowedPolicyMemberDomains organization policy is in

• A
  2% (1)
• B
  6% (3)
• C
  12% (6)
• D
  80% (39)

Explanation

The 'constraints/iam.allowedPolicyMemberDomains' policy set on the 'Apps' folder includes 'inheritFromParent: false', which means the folder's policy completely overrides the parent (organization-level) policy rather than merging with it. The Apps folder policy only permits members from flowlogistic.com. Because the project is a child of the Apps folder, the effective policy at that project level is the Apps folder's policy - which does not include terramearth.com. Therefore, attempting to grant access to [email protected] fails. The parent organization's allowance of terramearth.com is irrelevant because the folder's policy explicitly opts out of inheritance.

No community discussion yet for this question.