What are GCP project liens?

A GCP project lien is a restriction that prevents a Google Cloud project from being deleted until every lien on that project has been removed. Liens sit on the project itself, not on individual resources inside it. They are separate from IAM — holding the resourcemanager.projects.delete permission is not sufficient to delete a project that has an active lien.

How does a lien differ from IAM?

IAM controls who can perform operations. A lien is a state on the project that blocks a specific operation regardless of who is attempting it.

An identity with full project owner permissions can still be blocked from deleting a project if a lien exists. Removing the lien requires the resourcemanager.projects.updateLiens permission, which is distinct from the delete permission. This separation means that different teams or systems can manage deletion eligibility independently of the access controls that govern day-to-day project usage.

How do you create and remove a lien?

Liens are managed through the Resource Manager API. To create one:

curl -X POST \
  "https://cloudresourcemanager.googleapis.com/v1/liens" \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{
    "parent": "projects/my-project-id",
    "origin": "my-org/production-safeguard",
    "reason": "Production project — deletion requires change management approval.",
    "restrictions": ["resourcemanager.projects.delete"]
  }'

The API returns a lien resource name (e.g., liens/1234567890). To remove the lien:

curl -X DELETE \
  "https://cloudresourcemanager.googleapis.com/v1/liens/1234567890" \
  -H "Authorization: Bearer $(gcloud auth print-access-token)"

A project can have multiple liens from different origins. All must be removed before deletion is possible.

What does a project lien protect?

A lien protects against accidental or unauthorized deletion of the project itself. This is a meaningful protection because GCP project deletion is mostly irreversible within a short window (projects enter a 30-day pending deletion state, but restoring a project in that window requires quick action and the right permissions).

Liens are particularly useful for production projects that back customer-facing infrastructure, projects that contain shared VPC networks used by multiple workloads, or projects that house organization-wide resources like audit logs and centralized storage. They provide a backstop that requires an explicit, trackable step before deletion can proceed.

What does a project lien not protect?

A project lien says nothing about what happens inside the project. Compute Engine instances, Cloud SQL databases, Cloud Storage buckets, and every other resource within the project can be created, modified, or deleted by anyone who holds the relevant IAM permissions. The lien does not extend inward.

A lien also does not protect against someone who holds resourcemanager.projects.updateLiens. That permission allows lien removal, and once the lien is gone, deletion is unblocked. If this permission is widely held, the protection degrades significantly.

The gap this leaves is substantial in practice. Protecting the project container while leaving all contents unprotected means that an actor can cause serious damage — wiping databases, deleting storage buckets, stopping all compute — without ever needing to trigger the lien. And for the lien itself, there is no native mechanism to require approval before removal or to alert when a production lien is deleted. Intercepting lien removals on production projects and routing them through a review step requires action-level controls operating above the IAM layer — the gap that Korvalis is built to address.