PermissionsThe Enforce GCP Compute Engine Instances Do Not Use External IP Addresses policy pack requires 1 permission:compute.instances.deleteAccessConfig