4.9 Ensure That Compute Instances Do Not Have Public IP Addresses

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Compute instances should not be configured to have external IP addresses.

Rationale:

To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.

Impact:

Removing the external IP address from your Compute instance may cause some applications to stop working.

Solution

From Console:

Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.

Click on the instance name to go the the Instance detail page.

Click Edit.

For each Network interface, ensure that External IP is set to None.

Click Done and then click Save.

From Command Line:

Describe the instance properties:

gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE>

Identify the access config name that contains the external IP address. This access config appears in the following format:

networkInterfaces:
- accessConfigs:
- kind: compute#accessConfig
name: External NAT
natIP: 130.211.181.55
type: ONE_TO_ONE_NAT

Delete the access config.

gcloud compute instances delete-access-config <INSTANCE_NAME> --zone=<ZONE> --access-config-name <ACCESS_CONFIG_NAME>

In the above example, the ACCESS_CONFIG_NAME is External NAT. The name of your access config might be different.
Prevention:
You can configure the Define allowed external IPs for VM instances Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess

Default Value:

By default, Compute instances have a public IP address.

See Also

https://workbench.cisecurity.org/files/3817