Firewall rules should prohibit ingress from 0.0.0.0/0 to DNS port 53
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. The powerpipe check is titled "Ensure no open firewall rules allow ingress from 0.0.0.0/0 to DNS port 53".
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to DNS port 53.
What this control checks
Firewall rules should prohibit ingress from 0.0.0.0/0 to DNS port 53
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_dns_port_53.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_dns_port_53 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_dns_port_53
Last reviewed: 2026-10-09