As part of a security review you need to see who holds the Project Owner role in a GCP project. What should you do?

The gcloud projects get-iam-policy command is the correct way to retrieve the IAM policy for a specific project, which includes all role assignments, such as the Project Owner role. This command directly queries the current permissions. Checking project-wide SSH keys is irrelevant to IAM role assignments; these keys are used for SSH access to VMs, not for project-level role management. Identity-Aware Proxy (IAP) manages access to applications and resources based on identity, but it doesn't directly show project-wide IAM roles. Enabling Audit Logs would record future changes or access attempts, but it wouldn't show the current state of IAM roles without first performing an action that gets logged, and then filtering through logs is less direct than simply querying the policy.