Issue creating IAM deny policy

[sridharrapaka]

I'm trying to create an IAM deny policy, the role required looks already enabled "DenyAdmin" however I still can't create a deny policy, the button is disabled on console, if someone encountered this problem pls suggest if any solution for this..

[jamespatrickm]

Hi @sridharrapaka,

Welcome to Google Cloud Community!

Did you enable the required roles at the Organization level? To manage deny policies, make sure that the following permissions are enabled:

• To view deny policies:
• iam.denypolicies.get
• iam.denypolicies.list
• To create, update, and delete deny policies:
• iam.denypolicies.create
• iam.denypolicies.delete
• iam.denypolicies.get
• iam.denypolicies.update

If you have an administrator, ask them to grant you these permissions. Should you enable these permissions and still encounter the same issue, I highly recommend that you reach out to our 1:1 support for a deep dive on this issue. Please see our Cloud Customer Care documentation.

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

[bala_cloud]

I'm trying to create an IAM deny policy specifically for a set of users who have the Viewer role in a project, so they don't have access to billing information. Even though I’ve added the necessary billing-related permissions to deny access, the users are still able to view the billing details. Has anyone else encountered this issue? If so, could you suggest a solution?
These are the permissions

cloudasset.googleapis.com/assets.listCloudbillingBillingAccounts

cloudasset.googleapis.com/assets.listCloudbillingProjectBillingInfos

[AllenLaw]

you can contact me @Yark_Chen