Restrict VPC Peering Usage
More Info:
Ensure that “Restrict VPC Peering Usage” policy is enforced for your GCP organizations.Risk Level
MediumAddress
Security, Operational MaturityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of not restricting VPC Peering Usage in GCP using GCP Console, follow these steps:
- Open the GCP Console and navigate to the VPC Network page.
- Select the VPC network that needs to be remediated.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “VPC Network Peering” section and click on “Edit”.
- In the “Peering” tab, select the peering connection that needs to be restricted.
- In the “Details” section, click on the “Edit” button.
- In the “Restrict VPC network peering” section, select the “Only allow peering from the following VPC networks” option.
- Select the VPC networks that are allowed to peer with this VPC network.
- Click on the “Save” button to apply the changes.
- Repeat the above steps for all the VPC networks that need to be remediated.
Using CLI
Using CLI
To remediate the misconfiguration of “Restrict VPC Peering Usage” in GCP using GCP CLI, please follow the below steps:Replace [NETWORK_NAME] with the name of the VPC network that you want to update.
This command will disable VPC peering for the specified network.
- Open the Cloud Shell in your GCP Console.
- Run the following command to get a list of all the VPC networks in your project:
- Identify the VPC network that you want to update and note down its name.
- Run the following command to update the VPC network to restrict VPC peering usage:
- Verify that VPC peering is disabled for the network by running the following command:
- If the output of the above command shows “peerings: []”, it means VPC peering is disabled for the network.
Using Python
Using Python
To remediate the misconfiguration of “Restrict VPC Peering Usage” in GCP using Python, you can follow the below steps:
- First, you need to get the list of all the VPC networks in your GCP project using the
listmethod of thecomputeclient.
- Next, you need to get the list of all the peering connections in your project using the
listmethod of thecomputeclient.
- Once you have the list of VPC networks and peering connections, you can iterate through each peering connection and check if it is using the restricted VPC network.
-
In the above code, we are checking if the peering connection is using the restricted VPC network. If it is, we are disabling the peering connection using the
patchmethod of thecomputeclient. -
You can call the
restrict_vpc_peering_usagefunction with your GCP project ID to remediate the misconfiguration.