VPC subnets should have Private Google Access enabled
Google Compute Subnetwork should have Private Google Access enabled. Set `private_ip_google_access` to `true`. Private Google Access allows instances in a subnet to reach Google APIs and services via internal IP.
Private Google Access allows instances in a subnet to reach Google APIs and services via internal IP, which should be enabled for private networks.
What this control checks
google_compute_subnetwork must set private_ip_google_access to true
Common pitfalls
private_ip_google_access unsupported for some purposes
private_ip_google_access is not supported for subnetworks with the following purpose set: INTERNAL_HTTPS_LOAD_BALANCER, REGIONAL_MANAGED_PROXY, GLOBAL_MANAGED_PROXY.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.enable_network_private_google_access.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_74; KICS query "Google Compute Subnetwork with Private Google Access Disabled" (ee7b93c1-b3f8-4a3b-9588-146d481814f5); Trivy check GCP-0075.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
enable_network_private_google_access - Checkov Check:
CKV_GCP_74 - Powerpipe Control:
gcp_compliance.control.enable_network_private_google_access - KICS Query:
ee7b93c1-b3f8-4a3b-9588-146d481814f5 - Trivy Check:
GCP-0075
Last reviewed: 2026-10-09