Protect project liens by using Privileged Access Manager

Overview of Privileged Access Manager

Project liens are guardrails that explicitly block a project from being deleted. This page describes how to configure multi-party approval to protect your project liens on Google Cloud projects that contain backup vaults. This document assumes that you have Privileged Access Manager enabled for your organization.

Applying a project lien adds an essential layer of protection against accidental or unauthorized project deletion. However, principals with legacy basic permissions for project ownership can still remove the lien and delete the project. To prevent any user, regardless of their permissions, from removing project liens, you can establish a structured, multi-party approval workflow. Privileged Access Manager provides just-in-time, temporary privilege elevation with optional multi-party approval workflows. For more information, see Privileged Access Manager overview.

By leveraging Privileged Access Manager, your organization can ensure that critical permissions—specifically the ability to remove liens—are granted only temporarily and require explicit approval from a second authorized party.

The process for using Privileged Access Manager

The process for multi-party approval to remove project liens by using Privileged Access Manager involves three phases:

  1. Restrict permissions: An administrator sets up IAM to ensure no unauthorized user has permanent access to modify or delete liens.

  2. Configure access control: An administrator configures Privileged Access Manager to control access to the custom role required to remove liens, including setting up the multi-party approval workflow.

  3. Execute actions: When temporary elevated access is needed, a user requests the grant, an authorized approver reviews and approves, and the user then executes the required actions.

Restrict permissions and prepare Identity and Access Management (IAM)

The goal of this phase is to ensure no unauthorized user has permanent access to modify or delete liens. To complete the steps in this section, you must have the following roles:

  • Security Admin (roles/iam.securityAdmin) or Organization Administrator (roles/resourcemanager.organizationAdmin) to audit and modify role assignments.
  • Organization Role Administrator (roles/iam.organizationRoleAdmin) to create custom roles.

Audit existing roles for project lien administration rights

The legacy basic Owner role (roles/owner) contains the permission resourcemanager.projects.updateLiens (allows removal of project liens) by default.

Create the Lien Admin custom role

Because Privileged Access Manager doesn't support legacy basic roles (Owner, Editor, and Viewer), you need to create a custom role to grant temporary permissions.

  1. In the Google Cloud console, navigate to IAM & Admin > Roles.

    Go to Roles

  2. Click Create Role.

  3. Configure the role with the following settings (the values listed in this step are for example purposes):

    • Title: Lien Administrator

    • ID: lien_administrator

    • Role Launch Stage: General Availability

    • Permissions: Click Add Permissions and search for exactly: resourcemanager.projects.updateLiens.

  4. Click Create.

Configure Privileged Access Manager for multi-party approval

In this phase, you configure the Privileged Access Manager to control access to the Lien Admin custom role created in Create the Lien Admin custom role.

  1. Navigate to IAM & Admin > Privileged Access Manager. Ensure Privileged Access Manager is set up if this is your first time using it.

    Go to Privileged Access Manager

  2. In the Entitlements section, click Create.

    • Name: Enter a descriptive name (e.g., remove-project-lien).

    • Resource: Select the organization, folder (recommended), or specific project where you want this logic to apply.

    • Role: Select the Lien Administrator custom role created in the Restrict permissions phase.

    • Requester: Select the individual principals or the group of users who are allowed to request this permission (for example, devops-team@example.com).

  3. Configure the approval workflow. Check the box for Approval required and complete the following fields:

    • Approvers: Select the individual principals or groups who must approve requests (for example, team-leads@example.com).

    • Approver count: Set to 1 or more, depending on your policy.

  4. Configure the following settings:

    • Max duration: Set to 1 hour (This is typically sufficient to delete a lien, but adjust according to your needs).

    • Justification: Set to Required.

  5. Click Create.

Execute actions

Once the entitlement is configured, the workflow for a requester and an approver to delete a protected project is as follows:

  1. Request: made by a user who is a member of the configured requester group that needs to delete a project but is blocked by a lien. They navigate to the Privileged Access Manager console, locate the remove-project-lien entitlement, and click Request Grant.

  2. Approval: provided by a user who is a member of the configured approvers group that receives a notification, reviews the justification, and clicks Approve.

  3. Deleting the lien: the requester is temporarily granted the Lien Administrator role (resourcemanager.projects.updateLiens). They can now proceed to delete the lien, thereby enabling subsequent project deletion, using the following commands:

    gcloud alpha resource-manager liens list
gcloud alpha resource-manager liens delete LIEN_NAME

    Replace LIEN_NAME with the name of the lien you want to delete.

  4. Clean-up: After the configured duration, the Lien Administrator role is automatically revoked from the requester, removing their ability to modify liens.

What's next