function main(projectId, policyId, etag) {
  // [START iam_update_deny_policy]
  /**
   * TODO(developer): Uncomment and replace these variables before running the sample.
   */
  // const projectId = 'YOUR_PROJECT_ID';
  // const policyID = 'YOUR_POLICY_ID';
  // const etag = 'YOUR_ETAG';

  const {PoliciesClient} = require('@google-cloud/iam').v2;

  const iamClient = new PoliciesClient();

  // Each deny policy is attached to an organization, folder, or project.
  // To work with deny policies, specify the attachment point.
  //
  // Its format can be one of the following:
  // 1. cloudresourcemanager.googleapis.com/organizations/ORG_ID
  // 2. cloudresourcemanager.googleapis.com/folders/FOLDER_ID
  // 3. cloudresourcemanager.googleapis.com/projects/PROJECT_ID
  //
  // The attachment point is identified by its URL-encoded resource name. Hence, replace
  // the "/" with "%2F".
  const attachmentPoint = `cloudresourcemanager.googleapis.com%2Fprojects%2F${projectId}`;

  const denyRule = {
    // Add one or more principals who should be denied the permissions specified in this rule.
    // For more information on allowed values, see: https://cloud.google.com/iam/help/deny/principal-identifiers
    deniedPrincipals: ['principalSet://goog/public:all'],
    // Optionally, set the principals who should be exempted from the
    // list of denied principals. For example, if you want to deny certain permissions
    // to a group but exempt a few principals, then add those here.
    // exceptionPrincipals: ['principalSet://goog/group/project-admins@example.com'],
    // Set the permissions to deny.
    // The permission value is of the format: service_fqdn/resource.action
    // For the list of supported permissions, see: https://cloud.google.com/iam/help/deny/supported-permissions
    deniedPermissions: ['cloudresourcemanager.googleapis.com/projects.delete'],
    // Optionally, add the permissions to be exempted from this rule.
    // Meaning, the deny rule will not be applicable to these permissions.
    // exceptionPermissions: ['cloudresourcemanager.googleapis.com/projects.create']
    //
    // Set the condition which will enforce the deny rule.
    // If this condition is true, the deny rule will be applicable. Else, the rule will not be enforced.
    // The expression uses Common Expression Language syntax (CEL).
    // Here we block access based on tags.
    //
    // Here, we create a deny rule that denies the cloudresourcemanager.googleapis.com/projects.delete permission to everyone except project-admins@example.com for resources that are tagged test.
    // A tag is a key-value pair that can be attached to an organization, folder, or project.
    // For more info, see: https://cloud.google.com/iam/docs/deny-access#create-deny-policy
    denialCondition: {
      expression: '!resource.matchTag("12345678/env", "prod")',
    },
  };

  async function updateDenyPolicy() {
    const request = {
      policy: {
        name: `policies/${attachmentPoint}/denypolicies/${policyId}`,
        etag,
        rules: [
          {
            description:
              'block all principals from deleting projects, unless the principal is a member of project-admins@example.com and the project being deleted has a tag with the value prod',
            denyRule,
          },
        ],
      },
      policyId,
    };

    const [operation] = await iamClient.updatePolicy(request);
    const [policy] = await operation.promise();

    console.log(`Updated the deny policy: ${policy.name}`);
  }

  updateDenyPolicy();
  // [END iam_update_deny_policy]
}
Updates the deny rules and/ or its display name after policy creation.

@param {string} projectId - ID or number of the Google Cloud project you want to use.
@param {string} policyId - The ID of the deny policy you want to update.
@param {string} etag - Etag field that identifies the policy version. The etag changes each time
you update the policy. Get the etag of an existing policy by performing a GetPolicy request.