Firewall does not expose TCP port 22 (SSH) to the Internet

Check ID: compute_firewall_ssh_access_from_the_internet_allowed
Provider: GCP
Service: compute
Severity: CRITICAL
Categories: internet-exposed
Resource type: compute.googleapis.com/Firewall

What this check verifies

VPC firewall rules allowing Internet-sourced ingress (0.0.0.0/0) to TCP port 22 (SSH) are identified, including rules using protocol all or tcp whose ports or ranges include 22.

Risk

Exposed SSH (22) enables Internet-wide scanning, brute force and credential stuffing. Compromise can yield shell access for data exfiltration, command execution, and lateral movement, undermining confidentiality and integrity, and risking availability through abuse or lockouts.

Recommendation

Restrict SSH to trusted sources; avoid 0.0.0.0/0. Prefer bastion hosts or IAP TCP forwarding, or use VPN/peering. Enforce least privilege and defense in depth: limit to required CIDRs, use key-based auth, disable PasswordAuthentication, and monitor/alert on access attempts.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute firewall-rules update <example_resource_name> --source-ranges=<TRUSTED_CIDR>

resource "google_compute_firewall" "<example_resource_name>" {
  name    = "<example_resource_name>"
  network = "<example_resource_id>"

  source_ranges = ["<TRUSTED_CIDR>"] # Critical: removes 0.0.0.0/0 to stop exposing SSH to the Internet

  allow {
    protocol = "tcp"           # Critical: limit to SSH only
    ports    = ["22"]
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_firewall_ssh_access_from_the_internet_allowed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Firewall rule blocks Internet ingress to RDP port 3389 Compute Engine disk image is not publicly shared

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires