VM instance has 'Enable Connecting to Serial Ports' disabled

Check ID: compute_instance_serial_ports_in_use
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: identity-access
Resource type: compute.googleapis.com/Instance

What this check verifies

Compute Engine VM instance with the interactive serial console enabled via metadata serial-port-enable (1/true). Instances with this flag disabled do not allow interactive serial console connections.

Risk

Enabling the serial console creates out-of-band access that can bypass network controls. Abuse can grant low-level OS interaction, expose sensitive boot logs, alter configuration, or disrupt services, degrading confidentiality, integrity, and availability.

Recommendation

Disable the interactive serial console on production VMs (serial-port-enable=false). Use it only for break-glass cases. Enforce least privilege for console roles, prefer controlled access paths (IAP/SSH or session tools), and monitor access. Apply defense in depth to reduce alternate entry points.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances add-metadata <INSTANCE_NAME> --zone=<ZONE> --metadata=serial-port-enable=false

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params { image = "debian-cloud/debian-12" }
  }

  network_interface { network = "default" }

  metadata = {
    serial-port-enable = "false" # Critical: disables connecting to serial ports to pass the check
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_serial_ports_in_use. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

VM instance does not have a public IP address Compute instance has vTPM and Integrity Monitoring enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires