Question

Your organization has 12 projects. The security team has defined a custom IAM role with a specific set of permissions that they want to reuse and grant to principals in several of these projects. They want to manage a single definition of this custom role so that any future permission changes only need to be made once. Where should they create the custom role?

Accepted Answer

Create the custom role at the organization level, then grant it to principals in each project as needed

Answer

Create an identical custom role separately in each project that requires it

Answer

Create the custom role at the folder level and rely on inheritance to propagate the definition to all projects

Answer

Create a Google group, attach the permissions to the group, and add principals to the group