Question

A large enterprise has three business units, each managing multiple projects in Google Cloud. Central security requires that a security-audit team have read-only access to all resources across every project, that each business unit's admins manage only their own projects, and that a single org-wide policy prohibiting external IP addresses be enforced everywhere. The design must minimize the number of IAM bindings that need to be maintained as new projects are added. Which resource hierarchy and IAM design best meets these requirements?

Accepted Answer

Create a folder per business unit under the organization; grant the security-audit team the Viewer role at the organization node, grant each business unit's admins their roles at their respective folders, and apply the external-IP org policy at the organization node.

Answer

Grant all roles directly on each project as it is created, and duplicate the external-IP org policy on every project to guarantee enforcement.

Answer

Create a folder per business unit; grant the security-audit team Viewer on each individual project, grant business unit admins their roles at the organization node, and apply the org policy on each folder.

Answer

Place all projects directly under the organization with no folders; grant the security-audit team and each business unit's admins the Owner role at the organization node, relying on org policy to restrict actions.