Disable Default Firewall Rules

Ensures that Google Cloud’s default firewall rules are disabled, as they may be overly permissive and pose security risks. The default network comes with pre-populated firewall rules that allow broad access and should be replaced with more restrictive custom rules.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Replace default firewall rules with custom, more restrictive rules appropriate for your security requirements

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


resource "google_compute_firewall" "custom-ssh-access" {
  name    = "custom-ssh-access"
  network = "default"

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }

  source_ranges = ["192.168.1.0/24"]
  target_tags   = ["ssh-allowed"]
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_firewall