Firewall rule blocks Internet ingress to RDP port 3389

Check ID: compute_firewall_rdp_access_from_the_internet_allowed
Provider: GCP
Service: compute
Severity: CRITICAL
Categories: internet-exposed
Resource type: compute.googleapis.com/Firewall

What this check verifies

VPC firewall rules permitting inbound RDP (TCP 3389) from 0.0.0.0/0 are flagged, including ingress rules that allow all TCP ports or all protocols

Risk

Exposed RDP enables Internet-wide scanning and brute force. Exploits can yield remote code execution, followed by lateral movement and data theft. This endangers confidentiality, integrity, and availability (e.g., ransomware, service disruption).

Recommendation

Restrict RDP to trusted IP ranges or a hardened bastion/IAP proxy; prefer private access with no public IPs. Apply least privilege and network segmentation, use just-in-time access and strong authentication, and monitor logs. Aim for defense in depth to minimize exposure.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute firewall-rules delete <FIREWALL_RULE_NAME>

resource "google_compute_firewall" "<example_resource_name>" {
  name    = "<example_resource_name>"
  network = "<example_resource_id>"

  allow {
    protocol = "tcp"
    ports    = ["3389"]
  }

  source_ranges = ["10.0.0.0/8"] # CRITICAL: removes 0.0.0.0/0 so RDP is not exposed to the Internet
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_firewall_rdp_access_from_the_internet_allowed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud Storage services are protected by VPC Service Controls Firewall does not expose TCP port 22 (SSH) to the Internet

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires