IssueTracker

At this time, there seems to be no way to restrict Google Cloud Storage Transfer jobs (specifically GCS to GCS jobs) to buckets within the same organization. This could become an avenue for data exfiltration.

I'm hoping that a resource manager organization policy could be created to help enforce this. At this time, we have to:
- Greatly limit the list of people that have the ability to create or edit transfer jobs to be on the safe side
- Check whether or not a new/edited transfer job is using buckets not within our org

I do not see a policy around the transfer service in the documentation at this time: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints

Thanks!