Compute Instances Should Not Have Public IPs
More Info:
Compute instances should not be configured to have external IP addresses.Risk Level
HighAddress
SecurityCompliance Standards
CISGCP, CBP, SOC2, ISO27001, HITRUST, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Compute Instances Should Not Have Public IPs” in GCP using GCP console, please follow the below steps:
- Login to GCP console (https://console.cloud.google.com/).
- In the navigation menu, click on “Compute Engine”.
- Click on “VM instances”.
- Select the instance for which you want to remove the public IP.
- Click on “Edit” button at the top of the page.
- Scroll down to the “Network interfaces” section.
- Under “External IP”, select “None” from the dropdown menu.
- Click on “Save” to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration of compute instances having public IPs in GCP using GCP CLI, follow these steps:
- Open the GCP CLI and authenticate with your GCP account credentials.
-
Identify the instances that have public IPs assigned to them. You can use the following command to list all the instances in your project:
This will list all the instances in your project along with their details, including their public IPs.
-
Remove the public IP address from each instance using the following command:
Replace [INSTANCE_NAME] with the name of the instance that you want to remove the public IP from. This command will delete the external NAT access configuration from the instance, which will remove the public IP address.
- Repeat the above step for all the instances that have public IPs assigned to them until all the instances have their public IPs removed.
-
Verify that the instances no longer have public IPs assigned to them using the following command:
This will list all the instances in your project along with their details, including their IP addresses. Verify that the instances no longer have public IPs assigned to them.
Using Python
Using Python
To remediate the misconfiguration “Compute Instances Should Not Have Public IPs” in GCP using Python, you can follow the below steps:Step 1: Get a list of all the Compute Instances with Public IPs. This can be done by using the Google Cloud SDK and running the following command:This command will return a list of all the Compute Instances that have a Public IP associated with them.Step 2: Use the Google Cloud Python Client Library to update the instances and remove the Public IP. You can use the following Python script:This script will loop through all the instances with Public IPs and remove the Public IP from them. It will then print a message for each instance that has been updated.Step 3: Run the Python script to remediate the misconfiguration.Note: Before running the script, make sure you have set up the Google Cloud SDK and installed the Google Cloud Python Client Library.