How to prevent any user of my organisation from creating a GCP project

Question

I want only selected users of my organization to be able to create projects on GCP. GCP provides rights to an organization to create or delete projects. How can I narrow it down to a selective set of users to prevent additional costs to my organization?

Answer 1

By default, when the organization is created your entire domain is granted Project Creator and Billing Account Creator IAM roles at the organization level. This ensures that users in your domain will be able to continue creating projects as they did before and no disruption occurs.

The Organization Administrator will decide when they want to start actively using the organization. They can then change the default permissions and enforce more restrictive policies as needed.

If you want to limit project creation in your Organization, change the Organization access policy to grant the Project Creator role to a group that you manage.