GCP Troubleshooting
Select Organization Scope.
In GCP Console, select the scope dropdown located in the top left navbar, next to Google Cloud logo.
Choose “ALL” tab.
Choose the top organization.
Adding whitelist to Organization Policy.
Go to “IAM and admin”
From the left side menu, choose “Organization policies.”
Search for: “Domain restricted sharing”, click on it.
Click on “Manage Policy”
Under “Rules”,
you will see one of the existing rules, please expand it
Under “Custom values”, there could be some existing values.
Click “ADD VALUE”, and add following value without quotes: “principalSet://iam.googleapis.com/organizations/635452545508”
Click on “SET POLICY”
VPC Service Controls.
Go to “Manage VPC Service Controls”
Select the access policy.
Select perimeter item (which is blocking access to services like cloud asset & storage)
Click “EDIT” on the “Ingress policy” section.
Add a new rule using “ADD RULE”
For “FROM attributes of the API client”:
For “Identity”, choose “Selected identities”, add service account id (To obtain the service account ID, please follow these steps Retrieve the Service Account Id )
For “Source”, choose “All Sources.”
For “TO attributes of GCP services/resources”:
For “Project”, choose “All projects.”
For “All services”, choose “All services.”
Click on “SAVE”