許容可能なリソース構成を適用し、リスクの高い構成を防ぐポリシー制約を定義することをおすすめします。このブループリントでは、組織のポリシーの制約と Infrastructure as Code（IaC）の検証を組み合わせてパイプラインで使用します。これらの制御によって、ポリシー ガイドラインを満たしていないリソースの作成を防ぐことができます。ワークロードの設計と構築の早い段階でこれらの制御を適用することで、後で修復作業が発生する状況を回避できます。
組織ポリシーの制約
組織のポリシーサービスにより、十分な権限が付与された IAM ロールを持つユーザーであっても組織内で特定のリソース構成を作成できないように制約を適用します。 Google Cloud
このブループリントでは組織ノードにポリシーを適用し、組織内のすべてのフォルダとプロジェクトにこれらの制御が継承されるようにします。この一連のポリシーは、意図的にポリシーの例外を許可しない限り、公共のインターネットへの VM の公開やストレージ バケットへの公開アクセスの付与など、特定のリスクの高い構成を防ぐように設計されています。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-05-15 UTC。"],[],[],null,["# Preventative controls for acceptable resource configurations\n\nWe recommend that you define policy constraints that enforce acceptable\nresource configurations and prevent risky configurations. The blueprint uses a\ncombination of organization policy constraints and infrastructure-as-code (IaC)\nvalidation in your pipeline. These controls prevent the creation of resources\nthat don't meet your policy guidelines. Enforcing these controls early in the\ndesign and build of your workloads helps you to avoid remediation work later.\n\nOrganization policy constraints\n-------------------------------\n\nThe [Organization Policy](/resource-manager/docs/organization-policy/overview)\nservice enforces constraints to ensure that certain resource configurations\ncan't be created in your Google Cloud organization, even by someone with a\nsufficiently privileged IAM role.\n\nThe blueprint enforces policies at the organization node so that these controls\nare inherited by all folders and projects within the organization. This bundle\nof policies is designed to prevent certain high-risk configurations, such as\nexposing a VM to the public internet or granting public access to storage\nbuckets, unless you deliberately allow an exception to the policy.\n\nThe following table introduces the [organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints)\nthat are implemented in the blueprint:\n\nThese policies are a starting point that we recommend for most customers and\nmost scenarios, but you might need to modify organization policy constraints to\naccommodate certain workload types. For example, a workload that uses a\nCloud Storage bucket as the backend for Cloud CDN to host\npublic resources is blocked by `storage.publicAccessPrevention`, or a\npublic-facing Cloud Run app that doesn't require authentication is\nblocked by `iam.allowedPolicyMemberDomains`. In these cases, modify the\norganization policy at the folder or project level to allow a narrow exception.\nYou can also [conditionally add constraints to organization policy](/resource-manager/docs/organization-policy/tags-organization-policy#conditionally_add_constraints_to_organization_policy)\nby defining a tag that grants an exception or enforcement for policy, then\napplying the tag to projects and folders.\n\nFor additional constraints, see [available constraints](/resource-manager/docs/organization-policy/org-policy-constraints) and [custom constraints](/resource-manager/docs/organization-policy/creating-managing-custom-constraints).\n\nPre-deployment validation of infrastructure-as-code\n---------------------------------------------------\n\nThe blueprint uses a GitOps approach to manage infrastructure, meaning that all\ninfrastructure changes are implemented through version-controlled\ninfrastructure-as-code (IaC) and can be validated before deploying.\n\nThe [policies enforced in the blueprint](https://github.com/terraform-google-modules/terraform-example-foundation/tree/master/policy-library/policies/constraints)\ndefine acceptable resource configurations that can be deployed by your pipeline.\nIf code that is submitted to your GitHub repository does not pass the policy\nchecks, no resources are deployed.\n\nFor information on how pipelines are used and how controls are enforced through\nCI/CD automation, see [deployment methodology](/architecture/blueprints/security-foundations/deployment-methodology).\n\nWhat's next\n-----------\n\n- Read about [deployment methodology](/architecture/blueprints/security-foundations/deployment-methodology) (next document in this series)"]]
