Restrict resource deployments to only approved Google Cloud regions. What do you configure?

The correct answer is configuring an Organization Policy that constrains resource locations. Organization Policies are Google Cloud's centralized control mechanism for programmatic restriction over your organization's cloud resources. The gcp.resourceLocations constraint specifically allows you to define a list of allowed or denied regions and multi-regions for resource creation. This is the most effective and preventative way to enforce regional compliance. IAM conditions limit who can perform actions, not where resources can be deployed. Setting regional resource quotas to 0 is a reactive measure and doesn't prevent deployment attempts; it just prevents successful creation if the quota is hit. Cloud Monitoring alerts are also reactive, notifying you after a non-compliant resource has been created, requiring manual intervention to disable it.