Mountkirk Games wants to limit the physical location of resources to their operating Google Cloud regions. What should you do?

The correct answer is to configure an organizational policy that constrains where resources can be deployed. Google Cloud's Organization Policy Service allows you to define constraints across your organization's resources, including the "Resource Location Restriction" constraint. This constraint specifically limits the Google Cloud locations (regions and multi-regions) where newly created resources can be deployed, directly addressing Mountkirk Games' requirement. IAM conditions limit who can perform actions, not where resources can be deployed. Configuring quotas to 0 in unused regions is reactive and doesn't prevent creation attempts; it simply makes them fail, which isn't the most efficient or proactive solution. Custom alerts in Cloud Monitoring are also reactive, notifying you after a resource is created in an unauthorized region, requiring manual intervention to disable it, which is inefficient and doesn't prevent the initial deployment.