Question

A company's central platform team wants to ensure that only members of a dedicated "infra-admins" group can create new projects anywhere in the organization. Currently, many developers have the Project Creator role granted at the organization level because it was assigned broadly during initial setup. The security team wants to enforce this restriction while keeping existing folder and project-level IAM bindings intact. What is the most effective way to achieve this?

Accepted Answer

Remove the organization-level Project Creator (roles/resourcemanager.projectCreator) binding from the broad group and grant it only to the infra-admins group at the organization node.

Answer

Apply the constraints/iam.allowedPolicyMemberDomains organization policy so only infra-admins can create projects.

Answer

Create a custom role that omits the resourcemanager.projects.create permission and assign it to all developers at the organization level.

Answer

Enable the constraints/compute.restrictVpcPeering organization policy and add infra-admins to an exception list.