An inbound firewall rule allows traffic from /0. Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.
Impact
Recommended Actions Follow the appropriate remediation steps below to resolve the issue.
Terraform
Set a more restrictive cidr range
1
2
3
4
5
6
resource "google_compute_firewall" "good_example" {
source_ranges = [ "1.2.3.4/32" ]
allow {
protocol = "icmp"
}
}
1
2
3
4
5
6
7
8
9
10
11
12
resource "google_compute_firewall" "allow-vms-to-some-machine" {
name = "allow-vms-to-some-machine"
network = local . network
priority = 1300
direction = "INGRESS"
allow {
protocol = "tcp"
ports = [ "8081" ]
}
source_tags = [ "vms" ]
target_tags = [ "some-machine" ]
}
1
2
3
4
5
6
7
8
9
10
11
12
resource "google_compute_firewall" "test" {
name = "gmp-validating-webhook-fw"
network = google_compute_network . my_vpc_name . self_link
allow {
protocol = "tcp"
ports = [ "8443" ]
}
target_tags = [ "k8s-node-pool" ]
source_ranges = [ google_container_cluster . my_cluster_name . private_cluster_config [ 0 ]. master_ipv4_cidr_block ]
}
Links