Check Details

• Resource: Compute Engine VM Instance
• Check: Disallow public (external) IP addresses
• Risk: VM instances with public IPs are directly exposed to the internet, increasing the risk of brute-force attacks, exploitation, and unauthorized access.

Remediation via Google Cloud Console

1. Log in to the Google Cloud Console and navigate to the VM instances page: https://console.cloud.google.com/compute/instances
2. Click on the affected VM instance name to open the Instance details page.
3. Click Edit at the top of the page.
4. Under Network interfaces, ensure that External IP is set to None for each interface.
5. Click Done, then click Save to apply the changes.

Remediation via Google Cloud CLI

1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner.
2. Describe the instance to identify the external IP configuration:

   
   gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE>
   

3. Identify the access configuration that contains the external IP address. It appears similar to the following:

   
   networkInterfaces:
   
   - accessConfigs:
   
   - kind: compute#accessConfig
     name: External NAT
     natIP: 130.211.181.55
     type: ONE_TO_ONE_NAT
     

4. Delete the access configuration to remove the public IP address:

   
   gcloud compute instances delete-access-config <INSTANCE_NAME> \
    --zone=<ZONE> \
    --access-config-name <ACCESS_CONFIG_NAME>
   

Replace <INSTANCE_NAME>, <ZONE>, and <ACCESS_CONFIG_NAME> with your actual instance details.

Default Value

By default, Google Compute Engine VM instances are created with a public (external) IP address unless explicitly disabled during instance creation or configuration.