Security Issue : How to protect cloudbilling API call GetResourceBillingInfo ?

[tonymet]

Over the past week my audit log has shown repeated attempts to access billing information via GetResourceBillingInfo on cloudbilling.googleapis.com . The authenticationInfo is empty, so the call likely has no auth_token.  Even if access is denied, I would like to further protect API access.  I'm worried with enough tries that access will be breached?

What protections are available to control access to the API? Are there Web-Application firewall protections? Can I restrict IP / network access?

Error Log Summary

IP = 159.196.237.136
methodName = GetResourceBillingInfo
API = cloudbilling.googleapis.com

full log entry

{
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"status": {
"code": 7,
"message": "PERMISSION_DENIED"
},
"authenticationInfo": {},
"requestMetadata": {
"callerIp": "159.196.237.136",
"requestAttributes": {
"time": "2024-12-06T07:50:08.423Z",
"auth": {}
},
"destinationAttributes": {}
},
"serviceName": "cloudbilling.googleapis.com",
"methodName": "GetResourceBillingInfo",
"authorizationInfo": [
{
"resource": "projects/tonym-us",
"permission": "resourcemanager.projects.get",
"resourceAttributes": {},
"permissionType": "ADMIN_READ"
}
],
"resourceName": "projects/tonym-us",
"request": {
"@type": "type.googleapis.com/google.internal.cloudbilling.billingaccount.v1.GetResourceBillingInfoRequest",
"resourceName": "projects/tonym-us"
}
},
"insertId": "-t2uyyie1hsrw",
"resource": {
"type": "project",
"labels": {
"project_id": "tonym-us"
}
},
"timestamp": "2024-12-06T07:50:08.369396Z",
"severity": "ERROR",
"logName": "projects/tonym-us/logs/cloudaudit.googleapis.com%2Fdata_access",
"receiveTimestamp": "2024-12-06T07:50:08.862758679Z"
}

[tonymet]

https://issuetracker.google.com/issues/387234387 i filed an issue for this