We have a VPC Service Control in place with a Access Context Level attached to restrict apiplatform to a set of trusted IP addresses. We then have an alerting policy in place that will trigger whenever an attempt is logged.

This works fine, with the exception that occasionally it fires without proper cause. This can be once a week, or sometimes 2 or 3 times per day. The violation references our service control and the access level, but the request IP address is actually in the access level. It's also usually 1 blocked request, where we are doing thousands of requests per day from that IP address.

There's also no direct link to the event, like updating the service control or access level. Those have remained untouched for weeks.

When we run the troubleshooter on the failed request, it also confirms that our policies will not block the request.

Anyone else experienced something like this?