Google CloudOverview
Private Google Access enables your cluster hosts, which have only private IP addresses, to communicate with Google APIs and services using an internal IP address rather than an external IP address. External IP addresses are routable and reachable over the Internet. Internal (private) IP addresses are internal to Google Cloud Platform and are not routable or reachable over the Internet. You can use Private Google Access to allow VMs without Internet access to reach Google APIs, services, and properties that are accessible over HTTP/HTTPS.
Rationale
VPC networks and subnetworks provide logically isolated and secure network partitions where you can launch GCP resources. When Private Google Access is enabled, VM instances in a subnet can reach the Google Cloud and Developer APIs and services without needing an external IP address. Instead, VMs can use their internal IP addresses to access Google managed services. Instances with external IP addresses are not affected when you enable the ability to access Google services from internal IP addresses. These instances can still connect to Google APIs and managed services.
Remediation guidance
Using Console
- Go to Kubernetes GCP Console visiting https://console.cloud.google.com/kubernetes/list
- From the list of clusters, for each clusters note the
Subnetname - Go to VPC network GCP Console visiting https://console.cloud.google.com/networking/networks/list
- Click noted subnet, The
Subnet detailspage is displayed - Click on Edit button
- Set
Private Google accesstoOn - Click on Save
Using Command Line
To set Private Google access for a network subnet, run the following command:
gcloud compute networks subnets update \[SUBNET_NAME\] --region \[REGION\] --enable-private-ip-google-access
Impact
Instances with external IP addresses are not affected when you enable the ability to access Google services from internal IP addresses. These instances can still connect to Google APIs and managed services.
Default Value
By default, Private Google access is set to Off when you create a new cluster/cluster subnetwork.
References
- https://cloud.google.com/vpc/docs/configure-private-google-access
- https://cloud.google.com/vpc/docs/private-google-access
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Google Cloud
Use organization or folder policies where available, shared project templates, logs and alerting baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Private Google Access is set on Kubernetes Engine Cluster Subnets
Connectors
Covered asset types
Expected check: eq []
gkeClusters(where:{subnetworks_SOME:{privateIpGoogleAccess:false}}){...AssetFragment}
