Compute Engine instances should have 'Enable connecting to serial ports' disabled
Serial port access is not governed by network security rules, so the port can be exposed publicly. Compute Engine instances with the `Enable connecting to serial ports` flag disabled do not allow interactive serial console connections.
Enabling the serial console creates out-of-band access that can bypass network controls. When serial port access is enabled, the access is not governed by network security rules meaning the port can be exposed publicly. Abuse can grant low-level OS interaction, expose sensitive boot logs, alter configuration, or disrupt services.
What this control checks
Checks the Enable connecting to serial ports setting on Compute Engine instances
Common pitfalls
Template-based instances cannot pass without the key
If source_instance_template is set and serial-port-enable is not present, then this check cannot PASS, since we don't know what the underlying source template looks like.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_serial_ports_in_use (prowler gcp --checks compute_instance_serial_ports_in_use); PowerPipe control gcp_compliance.control.compute_instance_serial_port_connection_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_35; KICS query "Serial Ports Are Enabled For VM Instances" (97fa667a-d05b-4f16-9071-58b939f34751); Trivy check GCP-0032.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
NIST SP 800-53 Rev 5: Mapped to CM-6 (Configuration Settings) and CM-7 (Least Functionality).
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CM-7 Least Functionality
- Configuration Settings (CM-6)
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- 4.5 Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance
- 4.5 Ensure 'Enable Connecting to Serial Ports' Is Not Enabled for VM Instance
- 4.5 Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
- 4.5 Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
- 4.5 Ensure 'Enable connecting to serial ports' is not enabled for VM Instance
Related controls
- Compute Engine instances should all have OS Login enabled in the project
- Compute Engine instances should not use the default service account with full access to all Cloud APIs
- Firewall rules should prohibit unrestricted TCP/UDP access from the internet to all ports
- Firewall rules without specific targets should prohibit ingress from 0.0.0.0/0 to any port
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_serial_port_connection_disabled - Checkov Check:
CKV_GCP_35 - Powerpipe Control:
gcp_compliance.control.compute_instance_serial_port_connection_disabled - Prowler Check:
compute_instance_serial_ports_in_use - KICS Query:
97fa667a-d05b-4f16-9071-58b939f34751 - Trivy Check:
GCP-0032
Last reviewed: 2026-10-09