https://cloud.google.com/resource-manager/docs/creating-managing-organization

Centralize network control:
Use Shared VPC to connect to a common VPC network. Resources in those projects can communicate with each other securely and efficiently across project boundaries using internal IPs. You can manage shared network resources, such as subnets, routes, and firewalls, from a central host project, enabling you to apply and enforce consistent network policies across the projects.
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise- organizations#centralize_network_control

https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations- supported-services#compute-engine For example, an instance template is a global resource, but you might specify regional or zonal disks in an instance template. Those disks are subject to the resource locations constraints, so, in your instance template, you must specify disks in regions and zones that your org policy permits.