Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 9090
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. The powerpipe check ensures no open firewall rules allow ingress from 0.0.0.0/0 to port TCP 9090.
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to TCP port 9090.
What this control checks
Firewall rules that block public internet ingress to TCP port 9090
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_9090.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_tcp_port_9090 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_tcp_port_9090
Last reviewed: 2026-10-09