GKE clusters should have Alias IP ranges enabled at creation
Kubernetes Clusters must be created with Alias IP ranges enabled. The attribute `ip_allocation_policy` must be defined. If defined, the attribute `networking_mode` must be `VPC_NATIVE`.
IP aliasing allows the reuse of public IPs internally, removing the need for a NAT gateway.
What this control checks
GKE clusters are created with Alias IP ranges enabled
Common pitfalls
Checkov accepts any ip_allocation_policy value
The Checkov check inspects the key ip_allocation_policy and expects ANY_VALUE.
Defined ip_allocation_policy with networking_mode ROUTES
The attribute ip_allocation_policy must be defined and, if defined, the attribute networking_mode must be VPC_NATIVE.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.enable_alias_ip_ranges.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_23; KICS query "IP Aliasing Disabled" (c606ba1d-d736-43eb-ac24-e16108f3a9e0); Trivy check GCP-0049.
Framework-specific interpretation
PCI DSS v3.2.1: Mapped to 1.3.4 (Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet) and 1.3.7 (Do not disclose private IP addresses and routing information to unauthorized parties).
Framework mappings
The clauses this control is mapped to in each framework.
- 1.3.7 Do not disclose private IP addresses and routing information to unauthorized parties
- Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_alias_ip_ranges - Checkov Check:
CKV_GCP_23 - Powerpipe Control:
gcp_compliance.control.enable_alias_ip_ranges - KICS Query:
c606ba1d-d736-43eb-ac24-e16108f3a9e0 - Trivy Check:
GCP-0049
Last reviewed: 2026-10-09