Compute Engine instances should not have public IP addresses
Compute instances should not be configured to have external IP addresses. Trivy GCP-0031 states instances should not be publicly exposed to the internet. Checkov CKV_GCP_40 inspects `network_interface/[0]/access_config`.
Instances should not be publicly exposed to the internet.
What this control checks
Checks whether Compute Engine instances are configured with public IP addresses
Common pitfalls
Template-based instances without network_interface cannot PASS
If the source_instance_template value is present (indicating a google_compute_instance_from_template) and the network_interface block is not present, this check cannot PASS. The underlying source template is not known, so its network settings cannot be assessed.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_public_ip (prowler gcp --checks compute_instance_public_ip); PowerPipe control gcp_compliance.control.compute_instance_with_no_public_ip_addresses.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_40; Trivy check GCP-0031.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.4.2 (Network connections between trusted and untrusted networks are controlled.), 1.4.5 (Network connections between trusted and untrusted networks are controlled.) and 3 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-3 (Account Management), AC-5 (Separation Of Duties), AC-6 (Least Privilege) and 1 more clause.
NIST Cybersecurity Framework v2.0: Mapped to ID.AM-01 (Inventories of hardware managed by the organization are maintained.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
1 more clause
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- AC-5 Separation Of Duties
- AC-6: Least Privilege
- Access Enforcement (AC-3)
- Media Access (MP-2)
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- 4.9 Ensure That Compute Instances Do Not Have Public IP Addresses
- 4.9 Ensure That Compute Instances Do Not Have Public IP Addresses
- 4.9 Ensure that Compute instances do not have public IP addresses
- 4.9 Ensure that Compute instances do not have public IP addresses
- 4.9 Ensure that Compute instances do not have public IP addresses
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(3)(i) Workforce security
- 164.308(a)(3)(ii) Implementation specifications
- 164.312(a)(1) Access control
NIST Cybersecurity Framework v1.0
- PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should allow TCP traffic only from Google IP ranges for Identity-Aware Proxy (IAP)
- Compute Engine instances should have 'Enable connecting to serial ports' disabled
- Projects should prohibit default networks
- Compute Engine instance templates should have IP forwarding disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_with_no_public_ip_addresses - Checkov Check:
CKV_GCP_40 - Powerpipe Control:
gcp_compliance.control.compute_instance_with_no_public_ip_addresses - Prowler Check:
compute_instance_public_ip - Trivy Check:
GCP-0031
Last reviewed: 2026-10-09