I have am following the architecture described in the google documentation: https://cloud.google.com/vpc/docs/shared-vpc#hybrid_cloud_scenario
This hybrid cloud scenario enables me to have core services accessible within our on-site private network connected via VPN. The services (each of my teams) have their individual projects and use a shared subnet which I have provisioned and shared with that particular project.
The problem I have is how do I govern firewall rules? The projects themselves can't grant firewall rules but lets say I enable a firewall rule that assigns to the tag "public-ssh" which allows port 22 from
0.0.0.0/0. Anyone in that project can then make a network tag on their infrastructure and inherit this rule.
How do I deny the project teams from adding firewall rules via network tags, but still allow them to create infrastructure?