Firewall rules should prohibit ingress from 0.0.0.0/0 to FTP port 21
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. The powerpipe check "Ensure no open firewall rules allow ingress from 0.0.0.0/0 to FTP port 21" looks for open rules.
What this control checks
Firewall rules must not permit public internet ingress to FTP port 21
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_ftp_port_21.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP or UDP port 11211
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9160
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 27017-27019
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 7000 or 7001
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_ftp_port_21 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_ftp_port_21
Last reviewed: 2026-10-09