Other Articles

Compute Engine – Disable Serial Port Access

This check ensures that connecting to serial ports is disabled for Google Cloud Compute Engine VM instances. Disabling serial port access helps prevent unrestricted interactive access that could bypass standard authentication mechanisms.

Check Details

  • Resource: Compute Engine VM Instance
  • Check: Disable serial port access
  • Risk: Enabled serial port access can allow users to gain interactive access to VM instances, potentially bypassing IAM and SSH controls

Remediation via Google Cloud Console

  1. Log in to the Google Cloud Console and navigate to Compute Engine → VM instances. GCP VM Instances page
  2. Click on the affected VM instance to open its details page.
  3. Click Edit at the top of the page. Edit VM instance
  4. Scroll down to the Remote access section.
  5. Uncheck Enable connecting to serial ports. Disable serial port access
  6. Click Save to apply the changes.

Remediation via gcloud CLI

  1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner. GCP Cloud Shell
  2. Disable serial port access for the VM instance by running: 
    
gcloud compute instances add-metadata <INSTANCE_NAME> \
 --zone=<ZONE> \
 --metadata=serial-port-enable=false
  3. Alternatively, you can use: 
    
gcloud compute instances add-metadata <INSTANCE_NAME> \
 --zone=<ZONE> \
 --metadata=serial-port-enable=0

Replace <INSTANCE_NAME> and <ZONE> with the appropriate values for your VM.

Default Value

By default, connecting to serial ports is not enabled for Compute Engine VM instances.