A new security zone policy has been developed to ensure that Cloud Shell hosts in a security zone can't have public network access.

You can enable this new policy in your custom security zone recipes. The new policy is not enabled in the Maximum Security Recipe.