Permissions
The GCP CIS v2.0.0 - Section 3 - Networking policy pack requires 8 permissions:
compute.firewalls.deletecompute.firewalls.updatecompute.networks.deletecompute.sslPolicies.updatecompute.subnetworks.deletecompute.subnetworks.updatedns.managedZones.deletedns.managedZones.update