Control: Ensure Firewall Rules for instances behind Identity Aware Proxy (IAP) only allow the traffic from Google Cloud Loadbalancer (GCLB) Health Check and Proxy Addresses
Description
Access to VMs should be restricted by firewall rules that allow only IAP traffic by ensuring only connections proxied by the IAP are allowed. To ensure that load balancing works correctly health checks should also be allowed.
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iapSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.compute_firewall_allow_connections_proxied_by_iap --shareSQL
This control uses a named query:
compute_firewall_allow_connections_proxied_by_iap