Google Associate Cloud EngineerSetting up a cloud solution environmentMedium
A security auditor needs to verify that a Google Cloud project is correctly configured to prevent accidental deletion. They specifically want to ensure that the project itself cannot be deleted by anyone, including project owners, without first removing a specific lock. Which Google Cloud feature provides this protection?
- ACloud Audit Logs to monitor project deletion attempts.
- BOrganization Policy Service with a 'prevent deletion' constraint.
- CIAM Conditions to deny `project.delete` permission.
- DProject deletion lock (resource lock).
Show answer & explanationAnswer & explanation
Correct answer: D. Project deletion lock (resource lock).
Google Cloud's Project deletion lock (a type of resource lock) is specifically designed to prevent accidental deletion of a project. When applied, even project owners cannot delete the project until the lock is explicitly removed, providing a strong safeguard against unintended data loss.
Why the other options are wrong
- A. Cloud Audit Logs only monitor and record events; they do not prevent actions from occurring.
- B. Organization Policy Service primarily enforces constraints on resource configurations and locations, not on the deletion of the project itself in this manner. There isn't a direct 'prevent project deletion' constraint at the Org Policy level for individual projects, rather it's handled by Resource Manager locks.
- C. While IAM Conditions can deny permissions, a dedicated project deletion lock is a more robust and explicit mechanism for this specific use case.
GCP Project Deletion Lock
A Google Cloud project deletion lock is a type of resource lock that prevents a project from being deleted until the lock is explicitly removed, even by project owners.
- Protects against accidental project deletion.
- Must be explicitly removed before project deletion is possible.
- Applies to the entire project resource.
Memory trick: To 'lock' a project from 'deletion', use the 'deletion lock'.