IssueTracker

What you would like to accomplish:

I would like to request if it would be possible to add a disclaimer about the scope of each policy in the current documentation that presents all the organization policies.

Currently, the “iam.disableCrossProjectServiceAccountUsage” is a special Org Policy that is only visible & settable on the project level to prevent abuse. It is by default enforced everywhere

How this might work:

The best would be to add a disclaimer in each policy to know the scope that the policy could be applied (Organization, Folder, Project)

Other information (workarounds you have tried, documentation consulted, etc):

- Also, the constraint Disable Cross-Project Service Account Usage is always enforced as per [1]
- Found that the list of enforced default policies that are enforced per default to every resource of the organization can be found at [2].

[1]
https://cloud.google.com/iam/docs/attach-service-accounts#enabling-cross-project
[2]
https://cloud.google.com/resource-manager/docs/secure-by-default-organizations#organization_policies_enforced_on_organization_resources