Firewall rules should prohibit ingress from 0.0.0.0/0 to port 10250
Checks GCP Compute Engine firewall rules and flags any ingress rule that allows traffic from `0.0.0.0/0` to port `10250`. Firewall rules provide stateful filtering of ingress and egress network traffic to GCP resources.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to port 10250.
What this control checks
Checks firewall rules for ingress settings tied to 0.0.0.0/0 and port 10250
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10250.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
Related controls
- Firewall rules should have logging enabled
- VPC subnets should all have VPC Flow Logs enabled
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 636
- Firewall rules should prohibit ingress from 0.0.0.0/0 to NetBIOS session port 139
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 137-139
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10250 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_postgresql_port_10250
Last reviewed: 2026-10-09