Question

A European financial services company must ensure that all new Cloud Storage buckets and Compute Engine resources across its entire organization can only be created in EU-based regions, to satisfy GDPR data residency obligations. Developers currently have project-level permissions to create resources in any region. The architect needs an enforcement mechanism that applies organization-wide, cannot be bypassed by individual project owners, and does not depend on developers remembering to select the correct region. What should the architect implement?

Accepted Answer

Set the 'Resource Location Restriction' (constraints/gcp.resourceLocations) organization policy constraint at the organization node, allowing only EU value groups.

Answer

Grant developers a custom IAM role that only permits resource creation in EU regions and remove their broad project-editor roles.

Answer

Create a VPC Service Controls perimeter around all EU projects to block resource creation outside the EU.

Answer

Configure a Cloud Function triggered by audit logs that deletes any resource created outside an EU region.