> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict shared vpc subnetworks remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Restrict Shared VPC Subnetworks" misconfiguration in GCP using GCP console, you can follow these steps:

        1. Open the GCP console and go to the VPC network page.
        2. Select the shared VPC network for which you want to restrict subnetworks.
        3. In the "Subnetworks" section, click on the "Edit" button.
        4. In the "Subnetworks" dialog box, uncheck the "Allow new subnetworks in this VPC network" option.
        5. Click on the "Save" button to apply the changes.

        By following these steps, you have successfully restricted the creation of new subnetworks in the shared VPC network, which will help in preventing unauthorized access and potential security threats.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of "Restrict Shared VPC Subnetworks" in GCP using GCP CLI, you can follow the below steps:

        Step 1: Open the Cloud Shell

        Step 2: Run the below command to list all the subnetworks in the shared VPC:

        ```
        gcloud compute shared-vpc list-associated-resources [SHARED_VPC_NAME] --project=[HOST_PROJECT_ID] --subnet
        ```

        Note: Replace \[SHARED\_VPC\_NAME] and \[HOST\_PROJECT\_ID] with the actual shared VPC name and host project ID.

        Step 3: Run the below command to restrict the subnetworks in the shared VPC:

        ```
        gcloud compute shared-vpc update [SHARED_VPC_NAME] --project=[HOST_PROJECT_ID] --no-enable-flow-logs --no-enable-private-google-access --no-enable-intra-host-mtls --no-enable-intra-host-visibility --no-enable-routes-without-logs --no-enable-vpc-flow-logs --no-enable-private-endpoint
        ```

        Note: Replace \[SHARED\_VPC\_NAME] and \[HOST\_PROJECT\_ID] with the actual shared VPC name and host project ID.

        This command will disable all the shared VPC features which can be enabled on subnetworks.

        Step 4: Run the below command to verify the changes:

        ```
        gcloud compute shared-vpc describe [SHARED_VPC_NAME] --project=[HOST_PROJECT_ID]
        ```

        Note: Replace \[SHARED\_VPC\_NAME] and \[HOST\_PROJECT\_ID] with the actual shared VPC name and host project ID.

        This command will display the details of the shared VPC and confirm that the subnetworks are restricted.

        By following these steps, you can remediate the misconfiguration of "Restrict Shared VPC Subnetworks" in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of "Restrict Shared VPC Subnetworks" for GCP using Python, follow the below steps:

        1. First, you need to create a service account and download the JSON key for authentication.

        2. Install the Google Cloud SDK and the necessary Python libraries.

        3. Use the following Python code to remediate the misconfiguration:

        ```python theme={null}
        from google.cloud import compute_v1

        # Authenticate using the service account key
        client = compute_v1.SubnetworksClient.from_service_account_json('path/to/service_account_key.json')

        # Set the project ID and the name of the subnetwork to restrict
        project_id = 'your_project_id'
        subnetwork_name = 'your_subnetwork_name'

        # Get the subnetwork
        subnetwork = client.get(project=project_id, region='global', subnetwork=subnetwork_name)

        # Set the private IP Google access to "false"
        subnetwork.private_ip_google_access = False

        # Update the subnetwork
        response = client.update(project=project_id, region='global', subnetwork=subnetwork_name, subnetwork_resource=subnetwork)
        print('Subnetwork updated:', response)
        ```

        This code will set the "private\_ip\_google\_access" property of the subnetwork to "false", which will restrict shared VPC subnetworks.

        Note: Make sure to replace the "path/to/service\_account\_key.json", "your\_project\_id", and "your\_subnetwork\_name" with the actual values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_org_policy_policy" "restrict_shared_vpc_subnetworks" {
          # Substitute YOUR_ORG_ID with the numeric Organization ID (e.g. "123456789012").
          name   = "organizations/YOUR_ORG_ID/policies/constraints/compute.restrictSharedVpcSubnetworks"
          parent = "organizations/YOUR_ORG_ID"

          spec {
            rules {
              values {
                # List the fully-qualified subnetworks that are allowed to be used
                # in Shared VPC. Add one or more entries as needed.
                #
                # Example format:
                # "projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET_NAME"
                allowed_values = [
                  "projects/SHARED_VPC_HOST_PROJECT/regions/REGION/subnetworks/ALLOWED_SUBNETWORK_1",
                  "projects/SHARED_VPC_HOST_PROJECT/regions/REGION/subnetworks/ALLOWED_SUBNETWORK_2",
                ]
              }
            }
          }
        }
        ```

        Substitute:

        * `YOUR_ORG_ID` with your organization ID.
        * `SHARED_VPC_HOST_PROJECT`, `REGION`, `ALLOWED_SUBNETWORK_1`, etc., with the actual Shared VPC host project, region, and allowed subnet names.

        This change does not force replacement of existing projects or subnetworks, but it may block new/updated Shared VPC attachments that do not use one of the allowed subnetworks.

        Verification: `terraform plan` should show creation or update of `google_org_policy_policy.restrict_shared_vpc_subnetworks` with `name = organizations/YOUR_ORG_ID/policies/constraints/compute.restrictSharedVpcSubnetworks` and the intended `allowed_values` under `spec[0].rules[0].values[0]`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>