Protect projects with liens

Project liens are critical guardrails that prevent the accidental or malicious deletion of Google Cloud projects containing your immutable backups. In Backup and DR, these liens are enabled automatically for projects containing backup vaults with enforced retention. By explicitly blocking project deletion, liens ensure that enforced retention policies can't be bypassed by deleting the parent project.

Overview of project liens

Project liens are a feature of Resource Manager that explicitly block the deletion of a project. In Backup and DR, project liens add an essential layer of protection for backup vaults.

Backup and DR automatically applies a project-level lien to any project containing a backup vault with backups protected by enforced retention. This automatic protection helps secure your data without requiring manual configuration. However, you can also manually apply liens to projects for additional security, especially for testing environments or vaults without strict enforced retention.

Benefits of using liens

Using project liens provides the following security and operational benefits:

  • Strengthened enforced retention promise: Prevents project deletion from being used as a workaround to delete immutable backups. Even if a user has permissions to delete a project, the deletion is blocked if a lien is active.
  • Prevention of accidental deletion: Guards against administrative errors where a project might be deleted unintentionally during routine cleanup or maintenance.
  • Defense against malicious activity: Adds a barrier against ransomware or insider threats attempting to destroy backup data by deleting the parent project.

Considerations

When working with project liens in Backup and DR, keep the following points in mind:

  • Automatic liens: Backup and DR automatically applies liens only to projects containing vaults with backups protected by enforced retention. If you rely on vaults without enforced retention, for example, for testing, you must apply liens manually if you want this protection.

  • Lien removal: To delete a project, you must first remove the lien. Be aware of potential data loss if you remove a lien without proper justification. If you create a new backup with enforced retention in the project, Backup and DR re-applies the lien automatically. Therefore, we recommend that you remove the backup configurations so that new backups aren't created with enforced retention before you delete the project.

  • Multi-party approval: To prevent unilateral removal of liens, we strongly recommend configuring multi-party approval using Privileged Access Manager (PAM). For more information, see Protect project liens by using Privileged Access Manager.

Required roles

To get the permissions that you need to manage liens, ask your administrator to grant you the following IAM roles on the project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Before you begin

Ensure you have installed and initialized the gcloud CLI.

Add a lien manually

To place a lien on a project manually, use the gcloud alpha resource-manager liens create command.

gcloud alpha resource-manager liens create \
    --project=PROJECT_ID \
    --restrictions=resourcemanager.projects.delete \
    --reason="LIEN_REASON" \
    --origin="LIEN_ORIGIN"

Replace the following:

  • <var>PROJECT_ID</var>: the ID of the project the lien applies to.
  • <var>LIEN_REASON</var>: a human-readable description of why this lien exists.
  • <var>LIEN_ORIGIN</var>: a string denoting the user or system which originated the lien. This field is required, but is automatically populated with your email address if omitted.

Manage and list liens

To list all liens applied to a project, use the gcloud alpha resource-manager liens list command.

gcloud alpha resource-manager liens list

The output displays the lien name, origin, and reason.

Remove a lien

To remove a lien from a project, use the gcloud alpha resource-manager liens delete command.

gcloud alpha resource-manager liens delete LIEN_NAME

Replace <var>LIEN_NAME</var> with the name of the lien to be deleted (for example, p1061081023732-l3d8032b3-ea2c-4683-ad48-5ca23ddd00e7).

What's next