Enforce Data Sovereignty Resource Locations Policy

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational enterprise operating in the European Union must enforce strict data residency and sovereignty requirements across all its Google Cloud projects. The lead data engineer needs to systematically prevent teams from creating data storage and processing services—such as Cloud Storage buckets, BigQuery datasets, and Dataplex metadata assets—outside of approved European locations, while ensuring that existing production workloads are not abruptly disrupted.

Which strategy should the engineer implement to meet these requirements, and how will it behave upon enforcement?

Apply the Restrict Resource Service Usage constraint (gcp.restrictServiceUsage) with allowedValues set to European regional endpoints; this will retroactively disable existing services operating outside of Europe.

Configure the Resource Location Restriction constraint (gcp.resourceLocations) with deniedValues set to us-locations; this will automatically migrate all existing out-of-region storage objects into European regions.

Create a Common Expression Language (CEL) custom constraint on cloudresourcemanager.googleapis.com/Project to delete non-compliant resources; this enforces immediate compliance across past and future resources.

Apply the Resource Location Restriction constraint (gcp.resourceLocations) with allowedValues set to in:eu-locations at the organization node; this will block the creation of non-compliant new resources while allowing existing resources to continue operating.

Professional Cloud Data Engineer

Enforce Data Sovereignty Resource Locations Policy

Related questions