Question

A financial services company must ensure that all Compute Engine and Cloud Storage resources are created only in European regions to meet data residency requirements. The security team wants a preventive control enforced across the entire organization that blocks resource creation in any non-approved region, without relying on developers to remember the policy. Which approach best meets this requirement?

Accepted Answer

Apply the 'gcp.resourceLocations' organization policy list constraint at the organization node, setting allowed values to the approved European locations.

Answer

Create a custom IAM role that grants resource creation permissions only when the region attribute matches an approved European value.

Answer

Write a Cloud Function triggered by audit logs that deletes any resource detected in a non-European region.

Answer

Add an IAM deny policy at the organization level that denies all resource creation actions outside European regions.