iam_restrict_role.yaml

apiVersion: constraints.gatekeeper.sh/v1alpha1
kind: GCPIAMAllowedBindingsConstraintV3
metadata:
  name: restrict_owner_role
  annotations:
    description: Only my domain members are allowed to have the Owner role on projects
spec:
  severity: high
  match:
    ancestries:
    - "organizations/**"
    excludedAncestries: [] # optional, default is no exclusions
  parameters:
    mode: allowlist
    role: roles/owner
    members:
    - "user:*@google.com"
    - "group:*@google.com"