Question

A user was granted the Editor role at the organization level to help bootstrap several projects. The security team now wants this user to retain edit access only on the project called 'sandbox-dev' and lose edit access on all other current and future projects in the organization. What should you do?

Accepted Answer

Remove the user's Editor binding at the organization level, then grant the Editor role to the user on the 'sandbox-dev' project.

Answer

Keep the organization-level Editor binding and add an Editor deny policy on every project except 'sandbox-dev'.

Answer

Grant the user the Viewer role at the organization level and the Editor role on 'sandbox-dev', leaving the existing Editor binding in place.

Answer

Add an IAM condition to the organization-level Editor binding that restricts it to resources named 'sandbox-dev'.