You want to limit the images that can be used as the source for boot disks. These images will be stored in a dedicated project. What should you do?

Question

Options

• AUse the Organization Policy Service to create a compute.trustedimageProjects constraint on the
• BUse the Organization Policy Service to create a compute.trustedimageProjects constraint on the
• CIn Resource Manager, edit the project permissions for the trusted project. Add the organization as
• DIn Resource Manager, edit the organization permissions. Add the project ID as member with the

• A
  84% (31)
• B
  5% (2)
• C
  8% (3)
• D
  3% (1)

Explanation

The Organization Policy Service constraint compute.trustedimageProjects restricts which projects' images can be used as boot disk sources across your organization or a specific folder/project. By applying this constraint at the organization level and specifying your dedicated trusted-images project, you enforce that all VMs in the organization can only boot from approved, vetted images stored in that project. This is a scalable, policy-driven approach that does not require managing individual IAM bindings per project. Editing Resource Manager permissions (Options C and D) addresses resource access, not boot disk image restrictions.

No community discussion yet for this question.