def InstanceNetworkQuarantine(
    project_id: str,
    instance_name: str,
    exempted_src_ips: Optional[List[str]] = None,
    enable_logging: bool = False) -> None:
  """Put a Google Cloud instance in network quarantine.

  Network quarantine is imposed via applying deny-all
  ingress/egress firewall rules on each network interface.

  Args:
    project_id (str): Google Cloud Project ID.
    instance_name (str): : The name of the virtual machine.
    exempted_src_ips (List[str]): List of IPs exempted from the deny-all
        ingress firewall rules, ex: analyst IPs.
    enable_logging (bool): Optional. Enable firewall logging.
        Default is False.
  """
  logger.info(
      'Putting instance "{0:s}", in project {1:s}, in network '
      'quarantine.'.format(instance_name, project_id))
  project = gcp_project.GoogleCloudProject(project_id)
  instance = project.compute.GetInstance(instance_name)
  get_operation = instance.GetOperation()
  network_interfaces = get_operation['networkInterfaces']
  target_tags = []
  for interface in network_interfaces:
    network_url = interface["network"]
    # Adding a random suffix to the tag to avoid name collisions,
    # tags are used as firewall rule names, which need to be unique.
    tag_suffix = random.randint(10**(19), (10**20) - 1)
    deny_ingress_tag = 'deny-ingress-tag-' + str(tag_suffix)
    deny_egress_tag = 'deny-egress-tag-' + str(tag_suffix)
    AddDenyAllFirewallRules(
        project_id,
        network_url,
        deny_ingress_tag,
        deny_egress_tag,
        exempted_src_ips,
        enable_logging)
    target_tags.append(deny_ingress_tag)
    target_tags.append(deny_egress_tag)
  instance.SetTags(target_tags)
  if exempted_src_ips:
    logger.info(
        'From a host with an exempted IP, '
        'connect to the quarantined instance using:\n'
        'gcloud compute ssh --zone "{0:s}" "{1:s}" --project "{2:s}"\n'
        'Connecting from the browser via GCP console will not work.'.format(
            instance.zone, instance_name, project_id))
  # Then remove the VM's external IP address, to break all ongoing
  # connections
  logger.info('Removing external IP addresses to break ongoing connections')
  removed_ips = instance.RemoveExternalIps()
  # Now re-assign the IP address
  available_ips = set(project.compute.ListReservedExternalIps(instance.zone))
  for net_if, removed_ip in removed_ips.items():
    if removed_ip in available_ips:
      # IP address was static, re-assign static
      logger.info(
          'Re-assigning static IP {0:s} to {1:s}'.format(removed_ip, net_if))
      instance.AssignExternalIp(net_if, removed_ip)
    else:
      # IP address was ephemeral, re-assign ephemeral
      logger.info('Re-assigning ephemeral IP to {0:s}'.format(net_if))
      instance.AssignExternalIp(net_if, None)
Put a Google Cloud instance in network quarantine.

Network quarantine is imposed via applying deny-all
ingress/egress firewall rules on each network interface.

Args:
project_id (str): Google Cloud Project ID.
instance_name (str): : The name of the virtual machine.
exempted_src_ips (List[str]): List of IPs exempted from the deny-all
ingress firewall rules, ex: analyst IPs.
enable_logging (bool): Optional. Enable firewall logging.
Default is False.
libcloudforensics/providers/gcp/forensics.py