def AddDenyAllFirewallRules(
    project_id: str,
    network: str,
    deny_ingress_tag: str,
    deny_egress_tag: str,
    exempted_src_ips: Optional[List[str]] = None,
    enable_logging: bool = False) -> None:
  """Add deny-all firewall rules, of highest priority.

  Args:
    project_id (str): Google Cloud Project ID.
    network (str): URL of the network resource for thesee firewall rules.
    deny_ingress_tag (str): Target tag name to apply deny ingress rule,
        also used as a deny ingress firewall rule name.
    deny_egress_tag (str): Target tag name to apply deny egress rule,
        also used as a deny egress firewall rule name.
    exempted_src_ips (List[str]): List of IPs exempted from the deny-all
      ingress firewall rules, ex: analyst IPs.
    enable_logging (bool): Optional. Enable firewall logging.
        Default is False.

  Raises:
    InvalidNameError: If Tag names are invalid.
  """

  logger.info(
      'Creating deny-all (ingress/egress) '
      'firewall rules in {0:s} network.'.format(network))
  project = gcp_project.GoogleCloudProject(project_id)
  if not common.COMPUTE_RFC1035_REGEX.match(deny_ingress_tag):
    raise errors.InvalidNameError(
        'Deny ingress tag name {0:s} does not comply with {1:s}'.format(
            deny_ingress_tag, common.COMPUTE_RFC1035_REGEX.pattern),
        __name__)
  if not common.COMPUTE_RFC1035_REGEX.match(deny_egress_tag):
    raise errors.InvalidNameError(
        'Deny egress tag name {0:s} does not comply with {1:s}'.format(
            deny_egress_tag, common.COMPUTE_RFC1035_REGEX.pattern),
        __name__)

  source_range = common.GenerateSourceRange(exempted_src_ips)

  deny_ingress = {
      'name': deny_ingress_tag,
      'network': network,
      'direction': 'INGRESS',
      'priority': 0,
      'targetTags': [deny_ingress_tag],
      'denied': [{
          'IPProtocol': 'all'
      }],
      'logConfig': {
          'enable': enable_logging
      },
      'sourceRanges': source_range
  }
  deny_egress = {
      'name': deny_egress_tag,
      'network': network,
      'direction': 'EGRESS',
      'priority': 0,
      'targetTags': [deny_egress_tag],
      'denied': [{
          'IPProtocol': 'all'
      }],
      'logConfig': {
          'enable': enable_logging
      },
      'destinationRanges': ['0.0.0.0/0']
  }
  project.compute.InsertFirewallRule(body=deny_ingress)
  project.compute.InsertFirewallRule(body=deny_egress)
Add deny-all firewall rules, of highest priority.

Args:
project_id (str): Google Cloud Project ID.
network (str): URL of the network resource for thesee firewall rules.
deny_ingress_tag (str): Target tag name to apply deny ingress rule,
also used as a deny ingress firewall rule name.
deny_egress_tag (str): Target tag name to apply deny egress rule,
also used as a deny egress firewall rule name.
exempted_src_ips (List[str]): List of IPs exempted from the deny-all
ingress firewall rules, ex: analyst IPs.
enable_logging (bool): Optional. Enable firewall logging.
Default is False.

Raises:
InvalidNameError: If Tag names are invalid.
libcloudforensics/providers/gcp/forensics.py