You must enforce that all resources are deployed only in europe-west3 following Google-recommended practices. How should you enforce this at the organization level?

The correct answer is to set the constraints/gcp.resourceLocations organization policy constraint to in:europe-west3-locations. This is the recommended and most effective way to enforce resource location restrictions at the organization level in Google Cloud. Organization Policies provide centralized programmatic control over your cloud resources, ensuring compliance across all projects within the organization. Deploying resources with Terraform and adding a variable validation rule is insufficient because it only applies to resources deployed via that specific Terraform configuration and can be bypassed. Setting the constraint to in:eu-locations is too broad; it would allow deployment in any EU region, not specifically europe-west3. Creating a Cloud Function to detect and delete resources is a reactive solution, not a preventative one, and incurs additional cost and complexity while allowing non-compliant resources to exist, even if temporarily.