Question

Your company recently created a Google Cloud organization with the following resource hierarchy: an organization node, a 'Production' folder, and a 'Sandbox' folder. Leadership wants only members of a specific team to be able to create new projects, and only within the 'Sandbox' folder. Developers currently have broad access and are creating projects directly under the organization node. What is the recommended way to enforce this requirement?

Accepted Answer

Grant the Sandbox team the Project Creator (roles/resourcemanager.projectCreator) role on the 'Sandbox' folder, and remove Project Creator from the organization node for everyone else.

Answer

Grant the Sandbox team the Owner (roles/owner) role on the organization node so they can manage all project creation.

Answer

Apply a budget alert to the 'Sandbox' folder to prevent developers from creating projects elsewhere.

Answer

Ask each developer to create projects and then manually move any misplaced projects into the 'Sandbox' folder each week.