Question

A financial services company must ensure that IAM policies across all Google Cloud projects can only grant access to identities belonging to its corporate Cloud Identity domain. Auditors have flagged the risk of employees accidentally granting roles to personal Gmail accounts or external contractor accounts. The Cloud Architect wants a preventive, organization-wide control that blocks such grants automatically rather than relying on periodic manual review. Which approach best meets this requirement?

Accepted Answer

Apply the 'Domain restricted sharing' organization policy constraint at the organization node, allowing only the company's Cloud Identity customer ID.

Answer

Enable Cloud Audit Logs for IAM and configure a Cloud Function to remove any bindings that reference external accounts after they are created.

Answer

Use VPC Service Controls to create a perimeter that prevents external identities from accessing project resources.

Answer

Grant the Organization Administrator role only to a small central team and require them to review all IAM change requests manually.