How to copy image from one project to another

Since I cannot turn off the source VM because it is currently in use in a production environment, I have to use the following steps to create a mirror VM in another project:

1) Create a snapshot of the boot disk of the source VM

2) Create a disk based on this snapshot in the target project

 gcloud compute disks create vm-prod-disk --source-snapshot \
 https://www.googleapis.com/compute/v1/projects/<source-\
 project>/global/snapshots/<source-vm-snapshot> --project target-project

3) Create a VM based on the new disk from step 2

gcloud compute instances create vm-prod-duplicate \
--project target-project --disk name=vm-prod-disk,boot=yes

Permissions are inherited from the top, in this case from the organization:

By default, when the organization is created your entire domain is granted Project Creator and Billing Account Creator IAM roles at the organization level. This ensures that users in your domain will be able to continue creating projects as they did before and no disruption occurs.

The Organization Administrator will decide when they want to start actively using the organization. They can then change the default permissions and enforce more restrictive policies as needed.

In Using Resource Hierarchy for Access Control there's a gem at the very bottom:

If you want to limit project creation in your Organization, change the Organization access policy to grant the Project Creator role to a group that you manage.

Specifically, the role you want to disinherit is roles/resourcemanager.projectCreator:

Provides access to create new projects. Once a user creates a project, they're automatically granted the owner role for that project.