> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Serial Ports Connection Should Be Disabled ### More Info: Serial ports connection should not be enabled for VM instances. As serial console does not allow restricting IP Addresses, so then it allows any IP address to connect to instance and should therefore be disabled. ### Risk Level Low ### Address Security ### Compliance Standards * CIS GCP * Cloudanix Best Practice * HITRUST CSF * NIST CSF * PCI * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Serial Ports Connection Should Be Disabled" for GCP using GCP console, you can follow the below steps: 1. Login to the GCP console. 2. Select the project in which you want to remediate the misconfiguration. 3. Click on the "Compute Engine" option from the left-hand side menu. 4. Select the instance for which you want to disable the serial port connection. 5. Click on the "Edit" button at the top of the page. 6. Scroll down to the "Cloud API access scopes" section. 7. In the "Cloud API access scopes" section, click on the "Allow full access to all Cloud APIs" option to expand it. 8. Uncheck the "Enable connecting to serial ports" option. 9. Click on the "Save" button at the bottom of the page to apply the changes. 10. Once the changes are applied, the serial port connection will be disabled for the selected instance. By following the above steps, you can remediate the misconfiguration "Serial Ports Connection Should Be Disabled" for GCP using GCP console. # To remediate the misconfiguration of serial ports connection being enabled in GCP using GCP CLI, you can follow the below steps: 1. Open the Cloud Shell in the GCP Console. 2. Run the following command to list all the instances in your project: ``` gcloud compute instances list ``` 3. Choose the instance for which you want to disable serial port connection. 4. Run the following command to disable serial port connection for the chosen instance: ``` gcloud compute instances update [INSTANCE_NAME] --no-enable-serial-port ``` Replace \[INSTANCE\_NAME] with the name of the instance you want to remediate. 5. Verify that the serial port connection is disabled for the instance by running the following command: ``` gcloud compute instances describe [INSTANCE_NAME] | grep -i serial ``` This command should not return any output. By following these steps, you can remediate the misconfiguration of serial ports connection being enabled in GCP using GCP CLI. To remediate the "Serial Ports Connection Should Be Disabled" misconfiguration for GCP using Python, you can use the Cloud Asset Inventory and Cloud Asset API to identify and disable serial ports connections on all Compute Engine instances in your project. Here are the step-by-step instructions: 1. First, you need to enable the Cloud Asset API for your project. You can do this by going to the Google Cloud Console, selecting your project, and navigating to APIs & Services > Dashboard. Then, click on the "+ ENABLE APIS AND SERVICES" button, search for "Cloud Asset API", and click on the "ENABLE" button. 2. Next, you need to install the Google Cloud SDK and the Python client library for the Cloud Asset API. You can do this by running the following command in your terminal: ``` pip install google-cloud-sdk google-cloud-asset ``` 3. Once you have installed the necessary tools, you can use the following Python code to identify and disable serial ports connections on all Compute Engine instances in your project: ```python theme={null} from google.cloud import asset_v1 # Create a client object for the Cloud Asset API client = asset_v1.AssetServiceClient() # Define the project ID for your GCP project project_id = 'YOUR_PROJECT_ID' # Define the query to search for Compute Engine instances with serial ports connections enabled query = 'resource:"//cloudresourcemanager.googleapis.com/projects/{}/" ' \ 'AND resource_type="compute.googleapis.com/Instance" ' \ 'AND (serialPortConfigs.accessible=true OR serialPortConfigs.enable=true)'.format(project_id) # Execute the query and get the results response = client.search_all_resources(scope='projects/{}'.format(project_id), query=query) # Loop through the results and disable serial ports connections on each Compute Engine instance for result in response: if result.asset.resource_type == 'compute.googleapis.com/Instance': instance_name = result.asset.name.split('/')[-1] zone = result.asset.resource_data['zone'].split('/')[-1] instance_client = compute_v1.InstancesClient() instance = instance_client.get(project=project_id, zone=zone, instance=instance_name) if instance.serial_port_configs: instance.serial_port_configs = [] instance_client.update(project=project_id, zone=zone, instance=instance_name, body=instance) ``` 4. Replace "YOUR\_PROJECT\_ID" with your actual GCP project ID in the code. 5. Run the code in your terminal or in a Python IDE. This code will search for Compute Engine instances in your project that have serial ports connections enabled, and disable them by removing all serial port configurations. This will remediate the "Serial Ports Connection Should Be Disabled" misconfiguration for your GCP project. ```hcl theme={null} resource "google_compute_instance" "VM_INSTANCE" { name = "VM_INSTANCE_NAME" # replace with your VM name machine_type = "MACHINE_TYPE" # e.g. "e2-medium" zone = "ZONE" # e.g. "us-central1-a" boot_disk { initialize_params { image = "BOOT_IMAGE" # e.g. "debian-cloud/debian-12" } } network_interface { network = "NETWORK_NAME" # e.g. "default" subnetwork = "SUBNETWORK_NAME" # or omit if using default } // Disable serial ports connection for this instance metadata = { serial-port-enable = "0" # "0" or "false" both disable } } ``` This change updates instance metadata in place; it does not force replacement of the VM. To verify, `terraform plan` should show an in-place update on `google_compute_instance.VM_INSTANCE` adding or changing the `metadata.serial-port-enable` entry to `"0"`. ### Additional Reading: * [https://cloud.google.com/compute/docs/instances/interacting-with-serial-console](https://cloud.google.com/compute/docs/instances/interacting-with-serial-console)