Question

Your organization must ensure that no principal — regardless of any allow role they hold — can delete Cloud Storage buckets anywhere in the 'production' folder. Several project owners already have roles like roles/owner and roles/storage.admin that include the storage.buckets.delete permission. You want a solution that enforces this restriction centrally and takes precedence over existing allow grants. What should you do?

Accepted Answer

Create an IAM deny policy attached to the 'production' folder that denies the storage.buckets.delete permission for all principals.

Answer

Remove roles/owner and roles/storage.admin from every project owner in the folder and replace them with a custom role that omits storage.buckets.delete.

Answer

Add an IAM allow policy at the folder level granting roles/storage.objectViewer to all principals.

Answer

Create an organization policy constraint that restricts the storage.googleapis.com service in the 'production' folder.