function main(projectId, policyId) {
  // [START iam_get_deny_policy]
  /**
   * TODO(developer): Uncomment and replace these variables before running the sample.
   */
  // const projectId = 'YOUR_PROJECT_ID';
  // const policyID = 'YOUR_POLICY_ID';

  const {PoliciesClient} = require('@google-cloud/iam').v2;

  const iamClient = new PoliciesClient();

  // Each deny policy is attached to an organization, folder, or project.
  // To work with deny policies, specify the attachment point.
  //
  // Its format can be one of the following:
  // 1. cloudresourcemanager.googleapis.com/organizations/ORG_ID
  // 2. cloudresourcemanager.googleapis.com/folders/FOLDER_ID
  // 3. cloudresourcemanager.googleapis.com/projects/PROJECT_ID
  //
  // The attachment point is identified by its URL-encoded resource name. Hence, replace
  // the "/" with "%2F".
  const attachmentPoint = `cloudresourcemanager.googleapis.com%2Fprojects%2F${projectId}`;

  async function getDenyPolicy() {
    const request = {
      name: `policies/${attachmentPoint}/denypolicies/${policyId}`,
    };

    const [policy] = await iamClient.getPolicy(request);

    console.log(`Retrieved the deny policy: ${policy.name}`);
  }

  getDenyPolicy();
  // [END iam_get_deny_policy]
}
Retrieves the deny policy given the project ID and policy ID.

@param {string} projectId - ID or number of the Google Cloud project you want to use.
@param {string} policyId - The ID of the deny policy you want to retrieve.