Protect projects with liens

You can use Cloud de Confiance by S3NS project liens to protect critical projects from being accidentally or maliciously deleted. A lien blocks anyone from deleting a project until an Organization Administrator or Project Owner removes the lien.

Cloud de Confiance can also automatically apply liens to protect your resources. For example, if you attach a service account from one project to a resource in a different project, Cloud de Confiance places a lien on the project that owns the Identity and Access Management (IAM) service account to prevent broken dependencies.

Before you begin

The gcloud CLI is the easiest way to interact with project liens. If you don't have it installed, you can use Google Cloud Shell.

Required roles

To get the permissions that you need to modify liens, ask your administrator to grant you the Project lien modifier (roles/resourcemanager.lienModifier) IAM role on projects. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to modify liens. To see the exact permissions that are required, expand the Required permissions section:

You might also be able to get these permissions with custom roles or other predefined roles.

Place a lien on a project

To place a lien on a project, use the alpha resource-manager liens create command.

gcloud alpha resource-manager liens create \
    --project=PROJECT_ID \
    --restrictions=resourcemanager.projects.delete \
    --reason=LIEN_REASON \
    --origin=LIEN_ORIGIN

Replace the following:

• PROJECT_ID: ID of the project the lien applies to.
• LIEN_REASON: human-readable description of why this lien exists. Put this description within double quotation marks. Example: "This project is protected by a lien".
• LIEN_ORIGIN: string denoting the user or system which originated the lien. It's a required field, but is automatically populated with the user's email address if omitted.

List liens on a project

To list all liens applied to a project, use the alpha resource-manager liens list command.

gcloud alpha resource-manager liens list

The output is similar to the following:

NAME                                                  ORIGIN            REASON
p1061081023732-l3d8032b3-ea2c-4683-ad48-5ca23ddd00e7  user@example.com  testing

Remove liens from a project

To remove a lien from a project, use the alpha resource-manager liens delete command.

gcloud alpha resource-manager liens delete LIEN_NAME

Replace LIEN_NAME with the name of the lien to be deleted, such as p1061081023732-l3d8032b3-ea2c-4683-ad48-5ca23ddd00e7.

References

API Reference: REST Resource: liens