Check ID: compute_network_not_legacy
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: trust-boundaries
Resource type: compute.googleapis.com/Network

​
What this check verifies

Google Cloud networks are evaluated for legacy mode (subnet_mode: legacy). The finding highlights networks using the older, non-subnetted design instead of VPC with regional subnets.

​
Risk

Legacy networks lack subnets, peering, and private access. This reduces isolation and forces public IP paths, weakening confidentiality and enabling lateral movement/data exfiltration. Coarse controls and routing limits threaten integrity. A single global range and gateway create contention that can degrade availability.

​
Recommendation

Decommission legacy networks. Migrate to custom-mode VPCs with regional subnets and granular firewall policies. Apply least privilege segmentation, enable private access and Cloud NAT to avoid public exposure, and use peering or private connectivity for dependencies. Plan and test migration to limit downtime.

​
Remediation

gcloud beta compute networks update <LEGACY_NETWORK_NAME> —switch-to-custom-subnet-mode

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_network_not_legacy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks