Control: 4.9 Ensure that Compute instances do not have public IP addresses
Compute instances should not be configured to have external IP addresses.
To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.
To be able turn on Shielded VM on an instance, your instance must use an image with Shielded VM support.
- Login to VM instances.
- Click on the instance name to see its VM instance details page.
- Click EDIT
- For each
Network interface, ensure that
External IPis set to
- Click Done and then click Save.
From Command Line
- Describe the instance properties:
gcloud compute instances describe INSTANCE_NAME --zone=ZONE
- Identify the access config name that contains the external IP address. This access config appears in the following format:
networkInterfaces:- accessConfigs:- kind: compute#accessConfigname: External NATnatIP: 18.104.22.168type: ONE_TO_ONE_NAT
- Delete the access config.
gcloud compute instances update INSTANCE_NAME --shielded-vm-secure-boot
- Restart the instance:
gcloud compute instances delete-access-config INSTANCE_NAME --zone=ZONE --access-config-name "ACCESS_CONFIG_NAME"
Note: In the above example, the ACCESS_CONFIG_NAME is External NAT. The name of your access config might be different.
steampipe check gcp_compliance.control.cis_v120_4_9
This control uses a named query:compute_instance_with_no_public_ip_addresses