Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 8888
Checks GCP VPC firewall rules for any ingress `ALLOW` rule whose source range includes `0.0.0.0/0` and whose allowed protocols and ports cover `tcp` port `8888`. Rules that expose this port to any address are flagged as non-compliant.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to TCP port 8888.
What this control checks
Firewall rules that block ingress from 0.0.0.0/0 to TCP port 8888
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_8888.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 7199
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 27017-27019
- Firewall rules for IAP-protected instances should allow only Google Cloud Load Balancer health check and proxy traffic
- Projects should have log metric filters and alerts configured for VPC Network Firewall rule changes
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_tcp_port_8888 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_8888
Last reviewed: 2026-10-09