{
  "displayName": "IAM lab deny runtime object reads",
  "rules": [
    {
      "denyRule": {
        "deniedPrincipals": [
          "principal://iam.googleapis.com/projects/-/serviceAccounts/REPLACE_RUNTIME_SA_EMAIL"
        ],
        "deniedPermissions": [
          "storage.googleapis.com/objects.get"
        ]
      }
    }
  ]
}