Shared VPC subnet permission Query

[Xienan]

I have created shared VPC in the host project and attach a service project with it. But even I only set up the individual subnet access when attaching the service project, I can still view all subnets in the service project and use any of them to create the vm. Is it that because my role is `editor` of the folder?

[guptasmile · Accepted solution]

Hi @Xienan,

A user who has the compute.networkUser role in the host project can see all subnets within attached service projects. Check your resource hierarchy. 

You can restrict by giving this role at subnet level only. Please follow this.

https://cloud.google.com/vpc/docs/provisioning-shared-vpc#networkuseratsubnet

https://cloud.google.com/load-balancing/docs/org-policy-constraints#restrict_subnetworks