Shared VPC Query

[learningcloud44]

I have created shared VPC with user in host project, created three subnets and attached service project. I have given subnet level permission only for 2 subnets to service project ( for the user ). But in service project i can see all three subnets. User has organisation administrator, owner permissions which are inherited from organisation. Is this the reason why user can see all subnets in service project?

[grobledo]

Yes, both roles (Organization Administrator and Owner) allow you to get and list all the resources in the Organization/Project and are conflicting with the permissions given by the Service Project Admin. You need to revoke these roles first, but be very careful when revoking permissions to users as you can lose access to GCP resources inadvertently.