The Organization Policy Service provides a specific constraint called constraints/gcp.restrictServiceUsage.
This is the most direct and efficient way to "Allow" or "Deny" specific Google Cloud APIs (services) at any node in the hierarchy (Org, Folder, or Project).
According to Google Cloud Documentation (Restricting Resource Service Usage):
"The Restrict Resource Service Usage constraint allows enterprise administrators to control which Google Cloud services can be used within their Google Cloud resource hierarchy. This constraint can be enforced on an Organization, Folder, or Project. When applied at the folder level, it restricts service usage for all descendant projects within that folder." Why Option C is the most efficient:
* Targeted: By applying it directly to the folder, you don't need to manage complex "exceptions" at the Org level (as in Option B).
* Simple: It is a single policy rule that defines an "Allowlist" of services.
* IAM vs. Org Policy: IAM (Option A) controls who can do something, but Org Policy controls what can be done. Even if a user is an Editor, the Org Policy will block them from enabling a restricted API.
* VPC-SC (Option D): VPC Service Controls is much more complex and is used for data exfiltration prevention, not for simply restricting which APIs can be enabled/used in a project.
Reference:
Google Cloud Documentation: "Restricting resource usage" (https://cloud.google.com/resource-manager/docs
/organization-policy/restricting-resources).
Google Cloud Security Engineer Study Guide: Section on "Resource Hierarchy and Organization Policies."