Firewall rules should prohibit unrestricted TCP/UDP access from the internet to all ports
Checks for open firewall rules allowing TCP/UDP from the internet. The KICS check RDP Access Is Not Restricted checks if the Google compute firewall allows unrestricted RDP access. Allowed ports should not contain RDP port 3389.
What this control checks
Allowed ports in firewall rules must not include RDP port 3389
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls gcp_compliance.control.restrict_firewall_rule_rdp_world_open and gcp_compliance.control.restrict_firewall_rule_world_open_tcp_udp_all_ports.
Scans of the Terraform code that flag the same setting before deployment: KICS query "RDP Access Is Not Restricted" (678fd659-96f2-454a-a2a0-c2571f83a4a3).
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to POP3 port 110
- Firewall rules should prohibit ingress from 0.0.0.0/0 to NetBIOS session port 139
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 27017-27019
- Projects should have log metric filters and alerts configured for VPC Network Firewall rule changes
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_firewall_rule_world_open_tcp_udp_all_ports - Powerpipe Controls:
gcp_compliance.control.restrict_firewall_rule_rdp_world_open,gcp_compliance.control.restrict_firewall_rule_world_open_tcp_udp_all_ports - KICS Query:
678fd659-96f2-454a-a2a0-c2571f83a4a3
Last reviewed: 2026-10-10