And it's a compliance requirement -- you are actually required to block IPs of sanctioned countries and territories.

When I argued that Google Cloud must have been blocking those already, they told me to provide some evidence (a written confirmation from GCP that they block the IPs), which is fair.