Question

Your organization has thousands of projects and a broad set of principals who hold roles that include storage.buckets.delete and compute.instances.delete permissions through various inherited and directly-granted IAM roles. Security leadership mandates that no principal — regardless of any role grant, including at the project level — may delete Cloud Storage buckets across the entire organization, except for a break-glass group named org-admins@example.com. You want a centrally enforced control that overrides existing allow grants without editing every role or policy. What should you do?

Accepted Answer

Create an IAM deny policy attached at the organization node that denies storage.buckets.delete for all principals, with a denial exception for the org-admins@example.com group.

Answer

Create a custom role that excludes storage.buckets.delete and reassign every principal to that custom role across all projects.

Answer

Apply the constraints/storage.uniformBucketLevelAccess organization policy constraint at the organization node to prevent bucket deletion.

Answer

Add an IAM condition to each allow binding that evaluates the resource type and blocks deletion actions on buckets.