1. Open the GCP Console and navigate to the GCP project where the PostgreSQL instance is located.
2. In the left-hand menu, click on “SQL” to open the Cloud SQL Instances page.
3. Locate the PostgreSQL instance that has the open port and click on its name to open the instance details page.
4. Click on the “Edit” button at the top of the page to open the Edit instance page.
5. Scroll down to the “Connections” section and locate the “Authorized networks” field.
6. Click on the “Add network” button to add a new network.
7. In the “Network” field, enter the IP address range or CIDR block that you want to authorize to access the instance.
8. Click on the “Save” button to save the changes.
9. Repeat steps 6-8 for any additional networks that need to be authorized.
10. Scroll down to the bottom of the Edit instance page and click on the “Save” button to apply the changes.

​

1. Open the Google Cloud Console and select the project where the PostgreSQL instance is running.
2. Open the Cloud Shell by clicking on the button located on the top right corner of the console.
3. Run the following command to list all the instances in the project:
   gcloud compute instances list
   
4. Identify the instance running PostgreSQL and note down its name.
5. Run the following command to SSH into the instance:
   gcloud compute ssh [INSTANCE_NAME]
   
   Replace [INSTANCE_NAME] with the name of the instance running PostgreSQL.
6. Once you are logged into the instance, open the PostgreSQL configuration file using the following command:
   sudo nano /etc/postgresql/[POSTGRESQL_VERSION]/main/postgresql.conf
   
   Replace [POSTGRESQL_VERSION] with the version of PostgreSQL installed on the instance.
7. Look for the following line in the configuration file:
   #listen_addresses = 'localhost'
   
   Uncomment the line by removing the ’#’ at the beginning and change the value to ‘localhost’ as shown below:
   listen_addresses = 'localhost'
   
8. Save the changes to the configuration file by pressing Ctrl+O and then exit the editor by pressing Ctrl+X.
9. Restart the PostgreSQL service using the following command:
   sudo service postgresql restart
   
10. Exit the SSH session by typing ‘exit’ in the terminal.
11. Finally, run the following command to verify that the PostgreSQL port is not open:
    nmap -p 5432 localhost
    
    The output should show that the port is closed.

1. Import the necessary libraries:
   from google.cloud import compute_v1
   import google.auth
   
2. Authenticate with Google Cloud:
   credentials, project = google.auth.default()
   compute = compute_v1.InstancesClient(credentials=credentials)
   
3. Define the project ID, zone, and instance name:
   project_id = 'your_project_id'
   zone = 'us-central1-a'
   instance_name = 'your_instance_name'
   
4. Get the instance details:
   instance = compute.get(project=project_id, zone=zone, instance=instance_name)
   
5. Check if the PostgreSQL port is open:
   postgresql_open = False
   for firewall in instance['networkInterfaces'][0]['accessConfigs'][0]['natIP']:
       if firewall['name'] == 'postgresql':
           postgresql_open = True
           break
   
6. If the PostgreSQL port is open, delete the firewall rule:
   if postgresql_open:
       firewall_body = {
           "name": "postgresql",
           "network": "global/networks/default",
           "direction": "INGRESS",
           "priority": 1000,
           "sourceRanges": ["0.0.0.0/0"],
           "allowed": [{
               "IPProtocol": "tcp",
               "ports": ["5432"]
           }]
       }
       compute.firewalls().delete(project=project_id, firewall='postgresql').execute()
   
   This will delete the firewall rule named “postgresql” that allows traffic on port 5432.
7. If the PostgreSQL port is not open, no action is required.
   else:
       print("PostgreSQL port is not open.")
   
   This will print a message indicating that the PostgreSQL port is not open. The complete Python code to remediate the PostgreSQL port open misconfiguration in GCP is as follows:
   from google.cloud import compute_v1
   import google.auth
   
   credentials, project = google.auth.default()
   compute = compute_v1.InstancesClient(credentials=credentials)
   
   project_id = 'your_project_id'
   zone = 'us-central1-a'
   instance_name = 'your_instance_name'
   
   instance = compute.get(project=project_id, zone=zone, instance=instance_name)
   
   postgresql_open = False
   for firewall in instance['networkInterfaces'][0]['accessConfigs'][0]['natIP']:
       if firewall['name'] == 'postgresql':
           postgresql_open = True
           break
   
   if postgresql_open:
       firewall_body = {
           "name": "postgresql",
           "network": "global/networks/default",
           "direction": "INGRESS",
           "priority": 1000,
           "sourceRanges": ["0.0.0.0/0"],
           "allowed": [{
               "IPProtocol": "tcp",
               "ports": ["5432"]
           }]
       }
       compute.firewalls().delete(project=project_id, firewall='postgresql').execute()
   else:
       print("PostgreSQL port is not open.")
   
   Replace the your_project_id and your_instance_name placeholders with the appropriate values for your GCP project and instance.