Default firewall rules should prohibit ingress from 0.0.0.0/0 except HTTP and HTTPS
Ensures that default firewall rules do not allow ingress from 0.0.0.0/0 to any port. This is not applicable to the default HTTP and HTTPS firewall rule. Trivy GCP-0073 ensures that Google Cloud's default firewall rules are disabled.
Google Cloud's default firewall rules "may be overly permissive and pose security risks." The default network comes with pre-populated firewall rules that allow broad access and should be replaced with more restrictive custom rules.
What this control checks
Default firewall rules must not allow ingress from 0.0.0.0/0 to any port, except HTTP and HTTPS
Common pitfalls
HTTP and HTTPS rule is not covered
This is not applicable to default HTTP and HTTPS firewall rule.
Default network has pre-populated rules
The default network comes with pre-populated firewall rules that allow broad access and should be replaced with more restrictive custom rules.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_default_rule_restrict_ingress_access_except_http_and_https.
Scans of the Terraform code that flag the same setting before deployment: Trivy check GCP-0073.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.) and PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.DS-02
- PR.IR-01
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to any port
- Firewall rules should prohibit unrestricted RDP access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9160
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9090
- Firewall rules should prohibit ingress from 0.0.0.0/0 to Oracle DB port 1521
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_default_rule_restrict_ingress_access_except_http_and_https - Powerpipe Control:
gcp_compliance.control.compute_firewall_default_rule_restrict_ingress_access_except_http_and_https - Trivy Check:
GCP-0073
Last reviewed: 2026-10-09