Skip to main content

lacework-global-306

4.9 Ensure That Compute Instances Do Not Have Public IP Addresses (Automated)​

Profile Applicability​

• Level 2

Description​

Do not configure compute instances to have external IP addresses.

Rationale​

To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.

Impact​

Removing the external IP address from your Compute instance may cause some applications to stop working.

Audit​

From Console:

  1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.

  2. For every VM, ensure that there is no External IP configured.

From Command Line:

gcloud compute instances list --format=json
  1. The output should not contain an accessConfigs section under networkInterfaces. Note that the natIP value is present only for instances that are running or for instances that are stopped but have a static IP address. For instances that are stopped and are configured to have an ephemeral public IP address, the natIP field will not be present. Example output:
networkInterfaces:
- accessConfigs:
 - kind: compute#accessConfig
 name: External NAT
 networkTier: STANDARD
 type: ONE_TO_ONE_NAT

Exception: Instances created by GKE should be excluded because some of them have external IP addresses and cannot be changed by editing the instance settings. Instances created by GKE should be excluded. These instances have names that start with "gke-" and are labeled "goog-gke-node".

Remediation​

From Console:

  1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.

  2. Click the instance name to go the the Instance detail page.

  3. Click Edit.

  4. For each Network interface, set External IP to None.

  5. Click Done and then click Save.

From Command Line:

  1. Describe the instance properties:
gcloud compute instances describe <instance_name> --zone=<zone>
  1. Identify the access config name that contains the external IP address. This access config appears in the following format:
networkInterfaces:
- accessConfigs:
 - kind: compute#accessConfig
 name: External Network Address Translation
 natIP: 130.211.181.55
 type: ONE_TO_ONE_NAT
  1. Delete the access config.
gcloud compute instances delete-access-config <instance_name> --zone=<zone> --access-config-name <access_config_name>

In the preceding example, the access_config_name is External Network Address Translation. The name of your access config might be different.

Prevention: To prevent configuration of VMs with public IP addresses, you can configure the Define allowed external IPs for VM instances Organization Policy. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess.

References​

https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses
https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances
https://cloud.google.com/compute/docs/instances/connecting-to-instance
https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip
https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints

Additional Information​

You can connect to Linux VMs that do not have public IP addresses by using Identity-Aware Proxy for TCP forwarding. Learn more at https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances

For Windows VMs, see https://cloud.google.com/compute/docs/instances/connecting-to-instance.

Last updated on