A cloud administrator is managing project lifecycles and governance across an enterprise Google Cloud resource hierarchy. The administrator must protect a critical security project named `shared-sec-ops` from accidental deletion, even by users holding the primitive Owner role. Additionally, an automated pipeline service account must be configured with the necessary permissions to move projects from the `Staging` folder to the `Production` folder. Which TWO configurations or actions fulfill these requirements?
- Create a project lien on `shared-sec-ops` specifying the `resourcemanager.projects.delete` restriction.Answer
- Grant the service account permissions to move projects on the source folder, the destination folder, and the target project.Answer
- CApply an Organization Policy constraint at the project level to disable project deletion for users with primitive roles.
- DSet a Billing Budget alert threshold at 100% on the `shared-sec-ops` project to automatically lock the project state against deletion.
- ERevoke the Project Owner role at the `Production` folder level to prevent child project owners from deleting projects.
Answer
To protect a project from accidental deletion, place a project lien restricting `resourcemanager.projects.delete`. To move a project between folders, ensure the service account has appropriate project move permissions across the source folder, destination folder, and project.
Creating a project lien with the `resourcemanager.projects.delete` restriction prevents the project from being deleted even by users with the primitive Owner role until the lien is removed. Furthermore, moving projects between folders requires `resourcemanager.projects.move` permissions across the source folder, destination folder, and the target project.
Step-by-Step Solution
Key Concept
GCP Project Lifecycle Management and Resource Hierarchy Security
Estimated Time:1m 30s