Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?

The organization has an active Domain Restricted Sharing policy (constraints/iam.allowedPolicyMemberDomains). This policy restricts IAM membership to principals (users, groups) that belong to the organization's specified Cloud Identity domain. Consequently, adding an external auditor's personal Google account (e.g., @gmail.com) to an IAM policy will be denied. The correct approach is to create a temporary user account for the auditor within the organization's Cloud Identity. This new identity will comply with the organization policy. To grant view-only access to all resources as required, the Viewer (roles/viewer) predefined role is the most appropriate choice, as it provides broad read-only permissions across the project.

A. The auditor's external Google account will be blocked by the Domain Restricted Sharing organization policy, preventing you from adding them to the project's IAM policy.
B. This option fails for the same reason as A; the auditor's external Google account is not in the allowed Cloud Identity domain and will be blocked.
D. While creating a Cloud Identity account is correct, the Security Reviewer role is too specific. The Viewer role is better suited for the requirement to "review all the resources."

1. Google Cloud Documentation

Organization Policy Constraints

iam.allowedPolicyMemberDomains: "By default

principals from any domain can be added to an IAM policy. The iam.allowedPolicyMemberDomains constraint allows you to define a list of one or more Cloud Identity or Google Workspace customer IDs. When this constraint is active

any principal that is added to an IAM policy must belong to one of the allowed customer IDs." This explains why an external account cannot be used.

2. Google Cloud Documentation

IAM

Predefined roles

Viewer role (roles/viewer): "Permissions for read-only actions that do not affect state

such as viewing (but not modifying) existing resources or data." This confirms the Viewer role is appropriate for the auditor's task.

3. Google Cloud Documentation

Cloud Identity

About Cloud Identity: "Cloud Identity is an Identity as a Service (IDaaS) solution that centrally manages users and groups. You can configure Cloud Identity to federate identities between Google and other identity providers

such as Active Directory and Azure Active Directory." This establishes Cloud Identity as the service for creating and managing the required user account.