cis-gcp-foundations-4-9

name	cis-gcp-foundations-4.9
description	Ensure That Compute Instances Do Not Have Public IP Addresses
category	cis-gcp-foundations
version	4.0.0
author	cyberstrike-official
tags	["cis","gcp","compute","virtual-machines","service-accounts"]
cis_id	4.9
cis_benchmark	CIS Google Cloud Platform Foundation Benchmark v4.0.0
tech_stack	["gcp"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.9 Ensure That Compute Instances Do Not Have Public IP Addresses (Automated)

Profile Applicability

• Level 2

Description

Compute instances should not be configured to have external IP addresses.

Rationale

To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.

Impact

Removing the external IP address from your Compute instance may cause some applications to stop working.

Audit

From Google Cloud Console

1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.
2. For every VM, ensure that there is no External IP configured.

From Google Cloud CLI

gcloud compute instances list --format=json

1. The output should not contain an accessConfigs section under networkInterfaces. Note that the natIP value is present only for instances that are running or for instances that are stopped but have a static IP address. For instances that are stopped and are configured to have an ephemeral public IP address, the natIP field will not be present. Example output:

networkInterfaces:
  - accessConfigs:
      - kind: compute#accessConfig
        name: External NAT
        networkTier: STANDARD
        type: ONE_TO_ONE_NAT

Exception

Instances created by GKE should be excluded because some of them have external IP addresses and cannot be changed by editing the instance settings. Instances created by GKE should be excluded. These instances have names that start with "gke-" and are labeled "goog-gke-node".

Remediation

From Google Cloud Console

1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.