You need to enable VPC Service Controls and allow changes to perimeters in existing environments...

[Reference: https://cloud.google.com/vpc-service-controls/docs/service-perimeters, In dry run mode, requests that violate the perimeter policy are not denied, only logged. Dry run mode is used to test perimeter configuration and to monitor usage of services without preventing access to resources. https://cloud.google.com/vpc-service-controls/docs/dry-run-mode, , , , , ]