Ensure that your Google Compute Engine instances are not configured to have external IP addresses in order to minimize their exposure to the Internet.
To reduce attack surface, Google Cloud virtual machine (VM) instances should not have public IP addresses attached. Instead, VM instances should be configured to run behind load balancers.
Note: VM Instances created by Google Kubernetes Engine (GKE) should be excluded as some of these instances have external IP addresses and cannot be reconfigured by editing the instance settings. The instances provisioned by GKE service have names that start with "gke-" and are labeled "goog-gke-node".
To determine if your Google Cloud virtual machine (VM) instances are configured to use public/external IP addresses, perform the following actions:
Remediation / Resolution
To remove the public (external) IP address from your Google Compute Engine instances, perform the following actions:
- Google Cloud Platform (GCP) Documentation
- Backend services overview
- Connecting to VMs using advanced methods
- Connecting to VMs
- Reserving a static external IP address
- CIS Security Documentation
- Securing Google Cloud Computing Platform
Unlock the Remediation Steps
Gain free unlimited access
to our full Knowledge Base
Over 750 rules & best practices
Get started for FREE
You are auditing:
Check for Virtual Machine Instances with Public IP Addresses
Risk level: High