GCP Introduction
GCP Pricing
GCP Threats
GCP Misconfigurations
- Getting Started with GCP Audit
- CloudSql Audit
- Cloud Tasks Monitoring
- Dataflow Monitoring
- Function Monitoring
- Monitoring Compliance
- PubSubLite Monitoring
- Spanner Monitoring
- NoSQL Monitoring
- Compute Audit
- IAM Audit
- BigQuery Monitoring
- CDN Monitoring
- DNS Monitoring
- KMS Monitoring
- Kubernetes Audit
- Load Balancer Monitoring
- Log Monitoring
- Storage Audit
- Pub/Sub Monitoring
- VPC Audit
- IAM Deep Dive
GCP Threats
Compute Instances Should Not Have Public IPs
More Info:
Compute instances should not be configured to have external IP addresses.
Risk Level
High
Address
Security
Compliance Standards
CISGCP, CBP, SOC2, ISO27001, HITRUST, NISTCSF, PCIDSS, FedRAMP
Triage and Remediation
Remediation
To remediate the misconfiguration “Compute Instances Should Not Have Public IPs” in GCP using GCP console, please follow the below steps:
- Login to GCP console (https://console.cloud.google.com/).
- In the navigation menu, click on “Compute Engine”.
- Click on “VM instances”.
- Select the instance for which you want to remove the public IP.
- Click on “Edit” button at the top of the page.
- Scroll down to the “Network interfaces” section.
- Under “External IP”, select “None” from the dropdown menu.
- Click on “Save” to save the changes.
Once the changes are saved, the public IP will be removed from the instance and it will no longer be accessible publicly.
To remediate the misconfiguration of compute instances having public IPs in GCP using GCP CLI, follow these steps:
-
Open the GCP CLI and authenticate with your GCP account credentials.
-
Identify the instances that have public IPs assigned to them. You can use the following command to list all the instances in your project:
gcloud compute instances list
This will list all the instances in your project along with their details, including their public IPs.
-
Remove the public IP address from each instance using the following command:
gcloud compute instances delete-access-config [INSTANCE_NAME] \ --access-config-name "External NAT"
Replace [INSTANCE_NAME] with the name of the instance that you want to remove the public IP from. This command will delete the external NAT access configuration from the instance, which will remove the public IP address.
-
Repeat the above step for all the instances that have public IPs assigned to them until all the instances have their public IPs removed.
-
Verify that the instances no longer have public IPs assigned to them using the following command:
gcloud compute instances list
This will list all the instances in your project along with their details, including their IP addresses. Verify that the instances no longer have public IPs assigned to them.
By following these steps, you can remediate the misconfiguration of compute instances having public IPs in GCP using GCP CLI.
To remediate the misconfiguration “Compute Instances Should Not Have Public IPs” in GCP using Python, you can follow the below steps:
Step 1: Get a list of all the Compute Instances with Public IPs. This can be done by using the Google Cloud SDK and running the following command:
gcloud compute instances list --filter="networkInterfaces.accessConfigs.natIP:*"
This command will return a list of all the Compute Instances that have a Public IP associated with them.
Step 2: Use the Google Cloud Python Client Library to update the instances and remove the Public IP. You can use the following Python script:
from google.cloud import compute_v1
# Create a Compute Engine client object
compute_client = compute_v1.InstancesClient()
# Project ID for this request.
project = 'your-project-id' # TODO: Update placeholder value.
# Zone name for this request.
zone = 'us-central1-a' # TODO: Update placeholder value.
# Get the list of instances with public IPs
instances = compute_client.list(project=project, zone=zone, filter="networkInterfaces.accessConfigs.natIP:*")
for instance in instances:
# Remove the Public IP from the instance
instance.network_interfaces[0].access_configs[0].nat_ip = None
# Update the instance
operation = compute_client.update(project=project, zone=zone, instance=instance.name, instance=instance)
# Wait for the operation to complete
result = operation.result()
print(f"Public IP removed from instance {instance.name}")
This script will loop through all the instances with Public IPs and remove the Public IP from them. It will then print a message for each instance that has been updated.
Step 3: Run the Python script to remediate the misconfiguration.
Note: Before running the script, make sure you have set up the Google Cloud SDK and installed the Google Cloud Python Client Library.