Iam Deny Policy Hierarchy Inheritance 2

What IAM Deny Policy Evaluation Is

IAM deny policies provide declarative security guardrails that prevent principals from using specific permissions on Google Cloud resources and all of their descendant resources. Unlike IAM allow policies—which are additive and grant access—deny policies explicitly block access across the resource hierarchy.

How IAM Evaluates the Hierarchical Request

When a principal attempts to perform an operation on a Google Cloud resource, IAM performs a structured evaluation across all relevant policy types:

1. Principal Access Boundary (PAB) Evaluation: IAM checks whether the principal is restricted by relevant boundary policies.
2. Deny Policy Evaluation: IAM inspects all deny policies directly attached to the target resource as well as all inherited deny policies from parent folders and the organization node. If any applicable deny policy blocks the required permission for the principal (and no exception applies), access is immediately denied.
3. Allow Policy Evaluation: Only if no deny rule applies does IAM evaluate allow policies to confirm that the principal possesses the required role bindings.

In this scenario, because the Core-Infrastructure folder contains an active deny policy blocking cloudresourcemanager.googleapis.com/projects.delete for ops-engineers@example.com, the deny rule is inherited down to network-prod and halts the evaluation at stage 2.

Key Characteristics of Deny Policy Inheritance

• Strict Top-Down Inheritance: Deny policies flow down through descendants and cannot be overridden, masked, or bypassed by lower-level resource configurations.
• Non-Additive Precedence: Deny rules take absolute precedence over allow policies. Even a direct assignment of roles/resourcemanager.projectDeleter or roles/owner at the project level cannot grant access blocked by a parent deny rule.
• Immunity to Child Overrides: Unlike Organization Policies—which support inheritance override mechanisms like inheritFromParent: false—IAM deny policies enforce immutable denial across all descendants.