Permissions
The GCP CIS v2.0.0 - Section 3 - Networking policy pack requires 8 permissions:
compute.firewalls.delete
compute.firewalls.update
compute.networks.delete
compute.sslPolicies.update
compute.subnetworks.delete
compute.subnetworks.update
dns.managedZones.delete
dns.managedZones.update