Question

A financial services company uses Google Cloud across an organization node. During a security review, the team discovers that engineers have been sharing Cloud Storage buckets and IAM roles with Gmail accounts and external contractor domains. Leadership mandates that going forward, IAM policies may only grant access to identities belonging to the company's own Cloud Identity account and one approved partner's Cloud Identity account. Which approach enforces this requirement across all current and future projects with the least ongoing maintenance?

Accepted Answer

Apply the 'Domain restricted sharing' (iam.allowedPolicyMemberDomains) organization policy at the organization node, listing the customer IDs of both the company and the approved partner.

Answer

Create an IAM deny policy at the organization node that blocks setIamPolicy for any principal outside the company domain.

Answer

Write an IAM condition on every bucket that evaluates the requesting principal's email domain and rejects non-approved domains.

Answer

Enable the 'Disable service account key creation' organization policy and audit external grants weekly using Cloud Asset Inventory.