Beyond the News
Sign in
Cloud & InfrastructureCloud PlatformsDatabases & Storage Active dossier

Google Cloud Backup & DR will add project liens for retention-locked backups

From November 1, Google Cloud Backup & DR will automatically protect projects containing retention-locked backups with project liens, changing teardown and deletion workflows.

Reviewed and published by Lars Jansen Updated 3 min read
First published

Key details

  1. The change is scheduled for November 1, 2026.
  2. Automatic liens apply to projects containing Backup & DR backup vaults with backups under enforced retention.
  3. A project lien can block project deletion.
  4. Google links the change to guidance for protecting lien removal with Privileged Access Manager.
  5. The operational consequence is project-level, not limited to the backup resource itself.

What builders should take away

  1. Add a pre-delete check for Backup & DR retention state and project liens to project teardown automation.
  2. Document who is authorized to remove liens and require privileged approval rather than granting that permission broadly.
  3. Test disaster-recovery retention policies in disposable projects so operators understand how deletion behaves before the November rollout.
  4. Surface retention-lock and lien state in internal runbooks and offboarding checklists.

What changed

Google Cloud says that starting November 1, 2026, projects containing Backup & DR backup vaults with backups under enforced retention can receive automatic project liens. The liens are intended to prevent deletion of projects that still contain data protected by retention policy.

Why it matters

Infrastructure teams often assume project deletion is the final cleanup step. A retention-backed lien changes that lifecycle: teardown jobs can fail until the protected backup state is resolved, and lien-removal permissions become part of disaster-recovery and deletion governance.

Retention can now constrain the entire project lifecycle

The relevant condition is not merely that a project contains a backup vault; it is that retained backup data is protected under enforced retention. Google is using project liens to preserve that data against project deletion.

Deletion automation needs a new failure mode

Terraform destroy jobs, account-offboarding scripts and environment teardown pipelines should expect project deletion to be blocked when the lien exists. Operators should surface that state explicitly instead of treating deletion failure as an unknown control-plane error.

IAM around lien removal matters

Google's release notes point administrators toward Privileged Access Manager and project-lien protection guidance. Organizations should separate routine deployment roles from exceptional lien-removal authority and audit that path.

Timeline

2026-08

Google announces automatic Backup & DR project liens

Google added the upcoming change to Cloud release notes.
2026-11-01

Automatic lien behavior scheduled to begin

Projects with qualifying retention-locked backups can begin receiving automatic liens.

What to watch next

  • Whether Google publishes more precise rollout sequencing before November 1.
  • How lien removal interacts with organization policies and privileged-access workflows in large estates.
  • Any tooling updates in Terraform or gcloud that expose qualifying retention state more directly.

Still unclear

  • The exact timing within the November 1 rollout and edge cases for already-existing projects may vary by service rollout.
  • Organizations with custom organization policies may see different operational paths for lien removal.

Sources

Direct reading behind this dossier.

2 sources
Continue reading