Excessive firewall rules remediation

Using Console

To remediate firewall rules being too permissive in GCP using GCP console, follow these steps:

Log in to the GCP console at https://console.cloud.google.com/
Navigate to the VPC network for which you want to remediate the firewall rules.
Click on the “Firewall rules” tab.
Review the existing firewall rules and identify the ones that are too permissive.
Click on the checkbox next to the firewall rule that you want to modify.
Click on the “Edit” button at the top of the page.
Modify the firewall rule to be more restrictive by updating the source or destination IP addresses, protocols, or ports.
Click on the “Save” button to save the changes.
Repeat steps 5-8 for all the firewall rules that need to be remediated.

By following these steps, you can remediate the firewall rules being too permissive in GCP and ensure that your network is secure.

Using CLI

To remediate the firewall rules misconfiguration in GCP using GCP CLI, follow these steps:

Open the Cloud Shell in the GCP console.
Run the following command to list all the firewall rules in your project:

gcloud compute firewall-rules list

Identify the firewall rules that are not necessary or are overly permissive.
Delete the unnecessary firewall rules using the following command:

gcloud compute firewall-rules delete [FIREWALL_RULE_NAME]

Replace [FIREWALL_RULE_NAME] with the name of the firewall rule you want to delete. 5. Modify the overly permissive firewall rules to allow only necessary traffic. You can use the following command to update a firewall rule:

gcloud compute firewall-rules update [FIREWALL_RULE_NAME] --source-ranges=[IP_ADDRESS_RANGE] --allow=[PROTOCOL]:[PORT_NUMBER]/[PORT_PROTOCOL]

Replace [FIREWALL_RULE_NAME] with the name of the firewall rule you want to update, [IP_ADDRESS_RANGE] with the IP address range that should be allowed, [PROTOCOL] with the protocol that should be allowed (e.g. tcp), [PORT_NUMBER] with the port number that should be allowed, and [PORT_PROTOCOL] with the protocol of the port (e.g. tcp).By following these steps, you can remediate the firewall rules misconfiguration in GCP using GCP CLI.

Using Python

To remediate the firewall rules misconfiguration in GCP using Python, follow the steps below:

Import the required modules:

from google.cloud import firewall
from google.cloud import exceptions

Set up the GCP project and firewall client:

project_id = 'your-project-id'
client = firewall.FirewallClient()
firewalls = client.list(project=project_id)

Iterate through the firewall rules and delete any unnecessary rules:

for fw in firewalls:
    if fw.name == 'default-allow-http' or fw.name == 'default-allow-https':
        continue
    try:
        client.delete_firewall(fw.name, project=project_id)
        print(fw.name + ' deleted successfully')
    except exceptions.NotFound:
        print(fw.name + ' not found')

Save the Python script and run it to remediate the misconfiguration.

This Python script will delete all the firewall rules except for the default-allow-http and default-allow-https rules which are required for web traffic. By doing this, we are ensuring that the firewall rules are set to a minimum.

Using Terraform

resource "google_compute_firewall" "vpc_rules" {
  for_each = {
    for r in var.firewall_rules : r.name => r
  }

  name    = each.value.name
  network = var.VPC_NETWORK_SELF_LINK  # e.g. google_compute_network.main.self_link

  direction = each.value.direction      # "INGRESS" or "EGRESS"
  priority  = each.value.priority       # e.g. 1000

  allow {
    protocol = each.value.protocol      # e.g. "tcp"
    ports    = each.value.ports         # e.g. ["22","80","443"]
  }

  source_ranges      = each.value.source_ranges      # e.g. ["10.0.0.0/24"]
  destination_ranges = each.value.destination_ranges # usually [] for INGRESS

  target_tags        = each.value.target_tags        # optional
  source_tags        = each.value.source_tags        # optional
}
  
variable "firewall_rules" {
  description = "List of firewall rules for the VPC; must not exceed 30 entries."
  type = list(object({
    name               = string
    direction          = string
    priority           = number
    protocol           = string
    ports              = list(string)
    source_ranges      = list(string)
    destination_ranges = list(string)
    target_tags        = list(string)
    source_tags        = list(string)
  }))

  validation {
    condition     = length(var.firewall_rules) <= 30
    error_message = "Too many firewall rules defined: max_numbers = 30 for this VPC network."
  }
}

variable "VPC_NETWORK_SELF_LINK" {
  description = "Self-link of the VPC network to attach firewall rules to, e.g. google_compute_network.MY_VPC.self_link."
  type        = string
}

To remediate the finding, reduce var.firewall_rules to 30 or fewer entries (merge or delete rules as appropriate); terraform plan should then show at most 30 google_compute_firewall.vpc_rules resources, with any excess rules appearing as - destroy changes.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Excessive firewall rules remediation

Triage and Remediation

Remediation

​Triage and Remediation

​Remediation

​

Triage and Remediation

Remediation