Control: Ensure that IP forwarding is not enabled on Instances

Description

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.compute_instance_ip_forwarding_disabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.compute_instance_ip_forwarding_disabled --share

SQL

This control uses a named query:

select
  self_link resource,
  case
    when name like 'gke-%' and labels ? 'goog-gke-node' then 'skip'
    when can_ip_forward then 'alarm'
    else 'ok'
  end as status,
  case
    when name like 'gke-%' and labels ? 'goog-gke-node'
      then title || ' created by GKE.'
    when can_ip_forward
      then title || ' IP forwarding enabled.'
    else title || ' IP forwarding not enabled.'
  end as reason
  
  , location as location, project as project
from
  gcp_compute_instance;

Control: Ensure that IP forwarding is not enabled on Instances

Description

Usage

SQL

Tags