1. Login to the GCP console (https://console.cloud.google.com/).
2. Navigate to the Compute Engine section.
3. Select the instance where the SSH port is open.
4. Click on the “Edit” button at the top of the page.
5. Scroll down to the “Firewall” section and click on “Management, security, disks, networking, sole tenancy”.
6. Under the “Firewall” section, click on “Networking”.
7. In the “Firewall rules” section, find the firewall rule that is allowing SSH access (usually named “default-allow-ssh”).
8. Click on the checkbox next to the rule to select it.
9. Click on the “Delete” button at the top of the page.
10. Confirm the deletion by clicking on the “Delete” button in the confirmation dialog box.

​

1. Open the GCP CLI and connect to your project.
2. Run the following command to list all the instances in your project:
   Copy

   Ask AI

   gcloud compute instances list
   

3. Identify the instance for which you want to remediate the misconfiguration.
4. Run the following command to get the details of the instance:
   Copy

   Ask AI

   gcloud compute instances describe [INSTANCE_NAME]
   

   Replace [INSTANCE_NAME] with the name of your instance.
5. Look for the metadata section in the output. If you see a ssh-keys entry, then SSH port is open. To remediate this, delete the ssh-keys entry.
6. Run the following command to delete the ssh-keys entry:
   Copy

   Ask AI

   gcloud compute instances remove-metadata [INSTANCE_NAME] --keys ssh-keys
   

   Replace [INSTANCE_NAME] with the name of your instance.
7. Verify that the ssh-keys entry has been deleted by running the gcloud compute instances describe command again.
   Copy

   Ask AI

   gcloud compute instances describe [INSTANCE_NAME]
   

   You should not see the ssh-keys entry in the output.
8. Repeat steps 4-7 for all the instances in your project to ensure that SSH port is not open on any of them.

1. Import the necessary libraries:

from googleapiclient import discovery
from oauth2client.client import GoogleCredentials

2. Set up authentication credentials:

credentials = GoogleCredentials.get_application_default()
service = discovery.build('compute', 'v1', credentials=credentials)

3. Retrieve the project ID:

project = 'your-project-id'

4. Retrieve the list of instances:

instances = service.instances().list(project=project, zone='us-central1-a').execute()

5. Loop through the instances and update the firewall rules to restrict SSH access:

for instance in instances['items']:
    instance_name = instance['name']
    instance_zone = instance['zone'].split('/')[-1]
    firewall_name = 'ssh-' + instance_name
    firewall_body = {
        'allowed': [],
        'description': 'Restrict SSH access to specified IP ranges',
        'name': firewall_name,
        'network': 'default',
        'priority': 1000,
        'sourceRanges': [
            '0.0.0.0/0'
        ],
        'targetTags': [
            instance_name
        ]
    }
    firewall = service.firewalls().insert(project=project, body=firewall_body).execute()
    print('Firewall rule created for instance {}: {}'.format(instance_name, firewall['id']))

6. Remove the existing firewall rule that allows SSH access:

firewall_name = 'default-allow-ssh'
firewall = service.firewalls().delete(project=project, firewall=firewall_name).execute()
print('Firewall rule deleted: {}'.format(firewall_name))

7. Verify that the firewall rules have been updated:

firewalls = service.firewalls().list(project=project).execute()
for firewall in firewalls['items']:
    print(firewall['name'], firewall['sourceRanges'])