GCP Organization Policies: The Ten That Matter Most

The ten

1. compute.requireOsLogin — no more shared SSH keys.
2. compute.disableSerialPortAccess — closes a common lateral-movement path.
3. storage.uniformBucketLevelAccess — kills ACL-based public exposure.
4. storage.publicAccessPrevention — enforces bucket-level lockdown.
5. iam.disableServiceAccountKeyCreation — long-lived keys are a liability.
6. iam.automaticIamGrantsForDefaultServiceAccounts — deny.
7. sql.restrictPublicIp — no public IPs on Cloud SQL.
8. compute.vmExternalIpAccess — allowlist only.
9. iam.allowedPolicyMemberDomains — restrict IAM grants to your domain.
10. essentialcontacts.allowedContactDomains — same for security notifications.

Apply at the organization node, enforce in dry-run first, watch the audit logs for two weeks, then enforce.