Check ID: compute_instance_single_network_interface
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: trust-boundaries
Resource type: compute.googleapis.com/Instance

​
What this check verifies

VM instances should be configured with only one network interface unless multiple interfaces are explicitly required for complex network configurations. Multiple network interfaces expand the attack surface and create additional network pathways that may be exploited.

​
Risk

Multiple network interfaces on a VM instance can:
  • Expand attack surface by providing additional entry points for unauthorized access
  • Create unintended network paths that bypass security controls
  • Increase management complexity leading to potential misconfigurations

​
Recommendation

Configure VM instances with only the minimum network connectivity required for their intended purpose. Review instances with multiple network interfaces and consolidate to a single interface unless multi-NIC configuration is explicitly required for network appliance or routing purposes.

​
Remediation

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  # Only one network interface
  network_interface {
    network = "default"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_single_network_interface. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks