Question

A financial services company grants broad Editor roles to several project owners for agility. The security team must ensure that, regardless of any IAM allow bindings, no principal outside the company's security group can ever delete Cloud KMS keys or key versions across the entire organization — even if a project owner mistakenly grants such permissions. Which approach best enforces this organization-wide restriction?

Accepted Answer

Create an IAM deny policy at the organization node that denies the cloudkms.cryptoKeyVersions.destroy and related permissions to all principals except members of the security group

Answer

Remove all Editor role bindings and replace them with custom roles that exclude KMS delete permissions in every project

Answer

Configure an organization policy constraint to restrict KMS key deletion across all projects

Answer

Enable VPC Service Controls around all projects containing Cloud KMS keys to block delete operations