Analyze organization policies

This page contains information about analyzing your organization policy settings to see which resources are covered by which organization policy. Using Policy Analyzer for Organization Policy, you can create an analysis query to get information on both custom and predefined organization policies.

An analysis query is composed of a scope and a constraint.

Before you begin

  • Enable the Cloud Asset API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

    You must enable the API in the project you will use to send the query. This doesn't have to be the same resource that you scope your query to.

  • Optional: If you want to execute more than 20 policy analysis queries per organization per day, ensure that you have an organization-level activation of the Premium or Enterprise tier of Security Command Center. For more information, see Billing questions.

Required roles and permissions

To get the permissions that you need to run an organization policy analysis, ask your administrator to grant you the following IAM roles on the organization resource in which you want to conduct your analysis:

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to run an organization policy analysis. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to run an organization policy analysis:

  • To conduct the analysis:
    • cloudasset.assets.analyzeOrgPolicy
    • cloudasset.assets.searchAllResources
    • cloudasset.assets.searchAllIamPolicies
  • To view custom and managed constraints: orgpolicy.customConstraints.get

You might also be able to get these permissions with custom roles or other predefined roles.

Pricing and quota

Policy Analyzer for Organization Policy at scale (above 20 queries per organization per day) and inheritance visualizations are only available for customers with organization-level activations of Security Command Center.

Quota for Policy Analyzer for Organization Policy is shared among all Policy Analyzer tools. For more information, see Billing questions.

Analyze configured policies

An organization policy is built from a constraint and optional conditions under which that constraint is enforced. You can use Policy Analyzer to return a list of organization policies with a particular constraint and the resources to which those policies are attached.

For each organization policy that is detected in the query's scope, Policy Analyzer returns a result entry. A result entry contains the following fields:

  • consolidatedPolicy: the resource to which the organization policy is attached, and the effective policy enforcement on that resource with respect to hierarchy evaluation rules.

  • project: the ID of the project resource to which this consolidated policy belongs.

  • folders: the ID of any folder resources that are ancestors of the resource to which the organization policy is attached.

  • organization: the ID of the organization resource that is the ancestor of the resource to which the organization policy is attached.

  • policyBundle: the full configured organization policy attached to the above resource, and the organization policies defined on its ancestors in the resource hierarchy.

If your resources are protected by a VPC Service Controls service perimeter, you must create an egress rule in the perimeter of your organization resource that allows access to the cloudasset.googleapis.com service. Because method-level restrictions aren't supported for Cloud Asset API, you must allow all Cloud Asset API methods by specifying method: * in the egress rule. If you don't have an egress rule, the request fails with a NETWORK_NOT_IN_SAME_SERVICE_PERIMETER error. For more information, see Debugging requests blocked by VPC Service Controls.

Console

  1. In the Google Cloud console, go to the Policy Analyzer page.

    Go to Policy Analyzer

  2. In the Analyze organization policy section, find the pane labeled Where are specific organization policies configured? and click Create query in that pane.

  3. In the Select query organization box, select the organization for which you want to analyze organization policies.

  4. Select the type of constraint you want to analyze. For a predefined or managed constraint, select Built-in constraint. For a custom constraint, select Custom constraint.

  5. Enter the name of the constraint you want to analyze. The prefix for the type of constraint you are analyzing is already included. For example, for the predefined domain restriction constraint, enter iam.allowedPolicyMemberDomains, for the service account creation managed constraint, enter iam.managed.disableServiceAccountKeyCreation, and for a custom constraint, enter its name, such as disableGkeAutoUpgrade.

  6. Click Analyze, and then Run query. The report page shows the query parameters you entered, and a results table of all resources to which this constraint is directly applied.

  7. You can save this query to view again later by clicking Copy query URL. To view this query, navigate to the generated URL.

  8. You can visualize the inheritance of the constraint you analyzed by selecting at least one resource from the list, and then clicking View inheritance. You can also immediately go to the visualization view when you create your analysis query by clicking Analyze and then Visualize. See Visualize inheritance for more information.

gcloud

To get an analysis of how an organization policy constraint is enforced within an organization, use the gcloud asset analyze-org-policies command:

gcloud asset analyze-org-policies \
    --constraint=CONSTRAINT_NAME  \
    --scope=organizations/ORGANIZATION_ID \
    --limit=LIMIT_POLICIES \