VM instance does not have a public IP address

Check ID: compute_instance_public_ip
Provider: GCP
Service: compute
Severity: HIGH
Categories: internet-exposed
Resource type: compute.googleapis.com/Instance

What this check verifies

Compute Engine VM instances with an assigned external (public) IP address on any network interface are identified. Instances without an external IP are considered internal-only.

Risk

Internet-exposed VMs face automated scanning, brute force, and remote exploit attempts. Compromise can enable data exfiltration, service account abuse, and lateral movement within the VPC, while public endpoints invite DDoS, degrading availability.

Recommendation

Adopt private-only VMs and remove external IPs.

Place workloads behind load balancers or reverse proxies
Use Cloud NAT for egress; admin access via IAP, VPN, or a hardened bastion
Apply least privilege firewall rules and network segmentation for defense in depth

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances delete-access-config <example_resource_name> --access-config-name="External NAT" --zone=<example_resource_zone>

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "<example_resource_zone>"

  boot_disk {
    initialize_params { image = "debian-cloud/debian-11" }
  }

  network_interface {
    network = "default" # Critical: no access_config block -> no public IP
  }
}

References

https://cloud.google.com/compute/docs/instances/connecting-to-instance

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_public_ip. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

VM instance is not configured as preemptible or Spot VM VM instance has 'Enable Connecting to Serial Ports' disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires