Compute instances should not have public IP addresses

Description

Compute Engine instances should not have public IP addresses to reduce potential attack surfaces, as public IPs enable direct access via the internet. Instances serving internet traffic should be configured behind load balancers, which provide an additional layer of security.

Remediation Steps

Google Cloud Console

  • Navigate to VM instances.

  • Click on the instance name to go to the VM instance details page.

  • Click EDIT.

  • For each Network interface, ensure that External IP is set to None.

  • Click Done and then click Save.

gcloud CLI

  • Describe the Compute Engine instance properties:

    • gcloud compute instances describe INSTANCE_NAME --zone=ZONE

  • Identify the access config name that contains the external IP address, and then delete the access config:

    • gcloud compute instances delete-access-config INSTANCE_NAME --zone=ZONE -- access-config-name "ACCESS_CONFIG_NAME"