Google CloudOverview
Compute instances should not be configured to have external IP addresses.
Rationale
To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.
Impact
Removing the external IP address from your Compute instance may cause some applications to stop working.
Remediation guidance
From Google Cloud Console
- Go to the
VM instancespage by visiting: https://console.cloud.google.com/compute/instances - Click on each VM instance name to go to its details page
- Click
STOPand then clickEDIT - For each Network interface, ensure that External IP is set to None.
- Click
Saveand then clickSTART
Using Google Cloud CLI
- Describe the instance properties:
gcloud compute instances describe <instanceName> --zone=<zone>
- Identify the access config name that contains the external IP address. This access config appears in the following format:
networkInterfaces:
- accessConfigs:
- kind: compute#accessConfig
name: External NAT
natIP: 130.211.181.55
type: ONE_TO_ONE_NAT
- Delete the access config.
gcloud compute instances delete-access-config <instanceName> --zone=<zone> --access-config-name <accessConfigName>
In the above example, the accessConfigName is External NAT. The name of your access config might be different.
Prevention
You can configure the Define allowed external IPs for VM instances Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess
Default Value
By default, Compute instances have a public IP address.
References
- https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses
- https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances
- https://cloud.google.com/compute/docs/instances/connecting-to-instance
- https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip
- https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
Additional information
You can connect to Linux VMs that do not have public IP addresses by using IdentityAware Proxy for TCP forwarding. Learn more at https://cloud.google.com/compute/docs/instances/connectingadvanced#sshbetweeninstances. For Windows VMs, see https://cloud.google.com/compute/docs/instances/connectingto-instance.
Multiple Remediation Paths
Google Cloud
SERVICE-WIDE (RECOMMENDED when many resources are affected): Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
gcloud org-policies set-policy policy.yaml
ASSET-LEVEL: Use the product-specific remediation steps above for only the impacted project/resources.
PREVENTIVE: Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
gcloud org-policies set-policy policy.yaml
2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
Compute instances do not have public IP addresses
Connectors
Covered asset types
Expected check: eq []
{
vms(
where: {
networkInterfaces_SOME: { NOT: { accessConfigs_SOME: null } }
NOT: { name_STARTS_WITH: "gke-" }
}
) {
...AssetFragment
}
}
