A digital health platform based in Tokyo must guarantee that all newly created Cloud Storage buckets remain physically located within the asia-northeast1 region to adhere to local data residency compliance mandates. Which Google Cloud solution should the cloud architect implement to automatically enforce this restriction across all current and future projects?
- Define an Organization Policy using the Resource Locations constraint with allowed values set to asia-northeast1.Answer
- BRequire Customer-Supplied Encryption Keys (CSEK) for all storage buckets to define regional storage location boundaries.
- CEstablish a VPC Service Controls perimeter around Cloud Storage to enforce data location residency.
- DAssign the primitive Owner IAM role strictly to administrators physically located within the Tokyo office.
Answer
Define an Organization Policy using the Resource Locations constraint with allowed values set to asia-northeast1.
The Resource Locations constraint in Google Cloud Organization Policies (`constraints/gcp.resourceLocations`) allows cloud architects to specify the exact geographic locations where developers and automated tools are permitted to deploy GCP resources, ensuring strict adherence to data sovereignty regulations.
Step-by-Step Solution
Key Concept
Data Sovereignty via Resource Locations Organization Policy