Compute Instance Is Publicly Accessible

  • Query id: 8212e2d7-e683-49bc-bf78-d6799075c5a7
  • Query name: Compute Instance Is Publicly Accessible
  • Platform: GoogleDeploymentManager
  • Severity: High
  • Category: Networking and Firewall
  • URL: Github

Description

Compute instances shouldn't be accessible from the Internet.
Documentation

Code samples

Code samples with security vulnerabilities

Postitive test num. 1 - yaml file
resources:
- name: instance
  type: compute.v1.instance
  properties:
    scheduling:
      automaticRestart: true
    networkInterfaces:
      - accessConfigs:
        - name: External NAT
          type: ONE_TO_ONE_NAT
        network: network

Code samples without security vulnerabilities

Negative test num. 1 - yaml file
resources:
- name: instance2
  type: compute.v1.instance
  properties:
    scheduling:
      automaticRestart: true
    networkInterfaces:
      network: network