Firewall rules should prohibit ingress from 0.0.0.0/0 to HTTP port 80
Checks GCP Compute Engine firewall rules for ingress allowing `0.0.0.0/0` to HTTP port `80`. Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources, and this control flags rules that leave that port open.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to HTTP port 80.
What this control checks
Checks compute firewall rules for ingress access on HTTP port 80 from the public internet
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_http_port_80.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Default firewall rules should prohibit ingress from 0.0.0.0/0 except HTTP and HTTPS
- Firewall rules for IAP-protected instances should allow only Google Cloud Load Balancer health check and proxy traffic
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 6379
- Firewall rules should prohibit ingress from 0.0.0.0/0 to MongoDB port 27017
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9042
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_http_port_80 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_http_port_80
Last reviewed: 2026-10-09