Control: 4.9 Ensure That Compute Instances Do Not Have Public IP Addresses
Description
Compute instances should not be configured to have external IP addresses.
To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.
Remediation
To be able turn on Shielded VM on an instance, your instance must use an image with Shielded VM support.
From Console
- Gotothe
VM instances
page by visiting: https://console.cloud.google.com/compute/instances. - Click on the instance name to go the the
Instance detail page
. - Click
Edit
. - For each Network interface, ensure that
External IP
is set toNone
. - Click
Done
and then clickSave
.
From Command Line
- Describe the instance properties:
gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE>
- Identify the access config name that contains the external IP address. This access config appears in the following format:
networkInterfaces:- accessConfigs: - kind: compute#accessConfig name: External NAT natIP: 130.211.181.55 type: ONE_TO_ONE_NAT
- Delete the access config.
gcloud compute instances delete-access-config <INSTANCE_NAME> --zone=<ZONE> --access-config-name <ACCESS_CONFIG_NAME>
In the above example, the ACCESS_CONFIG_NAME
is External NAT
. The name of your access config might be different. The name of your access config might be different.
Prevention
You can configure the Define allowed external IPs for VM instances
Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess
Default Value
By default, Compute instances have a public IP address.
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.cis_v300_4_9
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.cis_v300_4_9 --share
SQL
This control uses a named query:
compute_instance_with_no_public_ip_addresses