lacework-global-306
4.9 Ensure That Compute Instances Do Not Have Public IP Addresses (Automated)
Profile Applicability
• Level 2
Description
Compute instances should not be configured to have external IP addresses.
Rationale
To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.
Impact
Removing the external IP address from your Compute instance may cause some applications to stop working.
Audit
From Console:
Go to the
VM instances
page by visiting: https://console.cloud.google.com/compute/instances.For every VM, ensure that there is no
External IP
configured.
From Command Line:
gcloud compute instances list --format=json
- The output should not contain an
accessConfigs
section undernetworkInterfaces
. Note that thenatIP
value is present only for instances that are running or for instances that are stopped but have a static IP address. For instances that are stopped and are configured to have an ephemeral public IP address, thenatIP
field will not be present. Example output:
networkInterfaces:
- accessConfigs:
- kind: compute#accessConfig
name: External NAT
networkTier: STANDARD
type: ONE_TO_ONE_NAT
Exception: Instances created by GKE should be excluded because some of them have external IP addresses and cannot be changed by editing the instance settings. Instances created by GKE should be excluded. These instances have names that start with "gke-" and are labeled "goog-gke-node".
Remediation
From Console:
Go to the
VM instances
page by visiting: https://console.cloud.google.com/compute/instances.Click on the instance name to go the the
Instance detail page
.Click
Edit
.For each Network interface, ensure that
External IP
is set toNone
.Click
Done
and then clickSave
.
From Command Line:
- Describe the instance properties:
gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE>
- Identify the access config name that contains the external IP address. This access config appears in the following format:
networkInterfaces:
- accessConfigs:
- kind: compute#accessConfig
name: External NAT
natIP: 130.211.181.55
type: ONE_TO_ONE_NAT
- Delete the access config.
gcloud compute instances delete-access-config <INSTANCE_NAME> --zone=<ZONE> --access-config-name <ACCESS_CONFIG_NAME>
In the above example, the ACCESS_CONFIG_NAME
is External NAT
. The name of your access config might be different.
Prevention:
You can configure the Define allowed external IPs for VM instances
Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess
References
https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses
https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances
https://cloud.google.com/compute/docs/instances/connecting-to-instance
https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
Additional Information
You can connect to Linux VMs that do not have public IP addresses by using Identity-Aware Proxy for TCP forwarding. Learn more at https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances
For Windows VMs, see https://cloud.google.com/compute/docs/instances/connecting-to-instance.