Indeed a great blog. I was doing a POC with CAA(Context Aware Access/GCP Baseline, a free version of BCE) to secure the access of Google Cloud Console & API by creating the access binding between a google group & access level(IP Based attribute).

I was bit surprised about creating the dry run configuration because it needs BCE subscription though I'm using CAA(GCP Baseline) for securing the GCP console (https://cloud.google.com/beyondcorp-enterprise/docs/securing-console-and-apis#create-dry-run) [In VPC SC, we can create dry run configuration free]

Probably a great business idea to sell the product :p (On funny side)