MEDIUM
Source
Trivy
ID
AVD-GCP-0071

SSH Access Is Not Restricted

Firewall rules should restrict SSH (TCP/22) access to specific IPs. Open SSH can be a security risk.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Restrict SSH (TCP port 22) access in firewall rules to known IP addresses or ranges. Avoid open 0.0.0.0/0 access for SSH.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
resource "google_compute_firewall" "good_example" {
  name    = "allow-ssh-from-specific-ip"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["192.168.1.0/24"]
  target_tags   = ["ssh-allowed"]
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
resource "google_compute_firewall" "allow-ssh-from-office" {
  name    = "allow-ssh-from-office"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["203.0.113.0/24"]
  target_tags   = ["web-servers"]
}