To enforce Data Residency at a platform level, Google Cloud provides the Resource Locations Organization Policy (constraints/gcp.resourceLocations).6 This is the authoritative way to prevent resources (like GKE clusters, Persistent Disks, or Cloud Storage buckets) from being created outside of a specific region.
According to Google Cloud Documentation (Organization Policy - Resource Locations):
"The Resource Locations constraint allows you to define the allowed locations (regions or multi-regions) for all supported Google Cloud services.7 By setting this policy at the project or folder level, you ensure that no user-regardless of their IAM permissions-can create resources in any region other than the one specified (e.
g., europe-west4)."
Why this is the best solution:
* Preventative: It blocks the API call itself if a user tries to deploy elsewhere.
* Efficient: It applies to all services within the project without needing custom code (like Option D) or manual reviews (Option B).
* Compliance-focused: It provides a clear audit trail and hard guarantee for compliance officers.
Reference:
Google Cloud Documentation: "Resource locations organization policy" (https://cloud.google.com/resource- manager/docs/organization-policy/defining-locations).