> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Restrict allowed apis services remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of "Restrict Allowed Google Cloud APIs and Services" in GCP using the GCP console, please follow the below steps: Step 1: Login to your Google Cloud Platform console. Step 2: Select the project you want to remediate the misconfiguration for. Step 3: Click on the Navigation menu, go to the "IAM & Admin" section, and select "IAM". Step 4: In the IAM page, select the role for which you want to restrict the allowed APIs and services. Step 5: Click on the "Edit" button next to the selected role. Step 6: Scroll down to the "Permissions" section and click on the "Add Condition" button. Step 7: In the "Add Condition" dialog box, select the "APIs & Services" option from the dropdown menu. Step 8: In the "APIs & Services" section, select the "APIs" tab and select the APIs and services you want to allow. Step 9: Click on the "Save" button to apply the changes. Step 10: Verify that the allowed APIs and services are restricted by checking the IAM page for the role you modified. By following these steps, you can remediate the misconfiguration of "Restrict Allowed Google Cloud APIs and Services" in GCP using the GCP console. # To remediate the "Restrict Allowed Google Cloud APIs and Services" misconfiguration in GCP using GCP CLI, you can follow the below steps: Step 1: Open the Cloud Shell in your GCP Console. Step 2: Run the following command to list all the enabled APIs and services in your project: ``` gcloud services list --enabled ``` Step 3: Identify the APIs and services that are not required for your project and note down their service names. For example, if you want to restrict the Cloud SQL Admin API, note down its service name "sqladmin.googleapis.com". Step 4: Run the following command to disable the unnecessary APIs and services: ``` gcloud services disable [SERVICE_NAME] ``` Replace \[SERVICE\_NAME] with the service name that you want to disable. For example, to disable the Cloud SQL Admin API, run the following command: ``` gcloud services disable sqladmin.googleapis.com ``` Step 5: Verify that the API or service has been disabled by running the following command: ``` gcloud services list --enabled ``` This will list all the enabled APIs and services in your project. Make sure that the API or service that you have disabled is not listed. By following the above steps, you can remediate the "Restrict Allowed Google Cloud APIs and Services" misconfiguration in GCP using GCP CLI. To restrict allowed Google Cloud APIs and Services in GCP using Python, you can follow the below steps: 1. Import the required libraries: ``` from googleapiclient import discovery from google.oauth2 import service_account ``` 2. Set up the credentials using the service account key file: ``` creds = service_account.Credentials.from_service_account_file('path/to/service_account_key.json') ``` 3. Set up the client for the Service Usage API: ``` service = discovery.build('serviceusage', 'v1', credentials=creds) ``` 4. Define the project ID and the list of APIs and Services to be restricted: ``` project_id = 'your-project-id' restricted_services = ['storage-component.googleapis.com', 'bigquery.googleapis.com'] ``` 5. Get the list of enabled services for the project: ``` enabled_services = service.services().list(parent=f'projects/{project_id}/services').execute() ``` 6. Disable the services that are not in the restricted list: ``` for service in enabled_services['services']: if service['config']['name'] not in restricted_services: service_name = service['config']['name'] service_version = service['config']['title'] print(f'Disabling service {service_name} ({service_version})...') service.services().disable(name=f'projects/{project_id}/services/{service_name}.{service_version}').execute() ``` 7. Verify that only the restricted services are enabled: ``` enabled_services = service.services().list(parent=f'projects/{project_id}/services').execute() for service in enabled_services['services']: if service['config']['name'] not in restricted_services: print(f'Error: Service {service["config"]["name"]} is still enabled.') ``` This Python script will restrict the allowed Google Cloud APIs and Services for the specified project. ```hcl theme={null} resource "google_org_policy_policy" "restrict_allowed_google_apis" { # Replace ORG_ID with your numeric organization ID, e.g. "123456789012" parent = "organizations/ORG_ID" name = "organizations/ORG_ID/policies/gcp.restrictServiceUsage" spec { # Do not inherit any broader (less restrictive) settings inherit_from_parent = false rules { values { # Replace/extend these with the exact set of services that ARE allowed # Every GCP API/service you want to permit must appear here. allowed_values = [ "in:compute.googleapis.com", "in:storage.googleapis.com", "in:bigquery.googleapis.com", # add more "in:SERVICE_NAME" entries as needed ] } } } } ``` This config attaches the “Restrict allowed Google Cloud APIs and services” organization policy at the org level; it does not force replacement of existing projects but will block enabling/using APIs not in the allowlist once enforced. To verify, `terraform plan` should show a new or updated `google_org_policy_policy.restrict_allowed_google_apis` with `name` ending in `policies/gcp.restrictServiceUsage` and a `spec.rules[0].values.allowed_values` list matching your chosen allowed services.