Back to Checks
gcp

VM instance does not have a public IP address

compute_instance_public_ip
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:compute.googleapis.com/Instance

Compute Engine VM instances with an assigned external (public) IP address on any network interface are identified.

Instances without an external IP are considered internal-only.

Prowler logoProwlerprowler-provider-gcp

Risk

Internet-exposed VMs face automated scanning, brute force, and remote exploit attempts.

Compromise can enable data exfiltration, service account abuse, and lateral movement within the VPC, while public endpoints invite DDoS, degrading availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_public_ip

Recommendation

Adopt private-only VMs and remove external IPs.

  • Place workloads behind load balancers or reverse proxies
  • Use Cloud NAT for egress; admin access via IAP, VPN, or a hardened bastion
  • Apply least privilege firewall rules and network segmentation for defense in depth

Remediation

CLI

gcloud compute instances delete-access-config <example_resource_name> --access-config-name="External NAT" --zone=<example_resource_zone>

Terraform

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"
  zone         = "<example_resource_zone>"

  boot_disk {
    initialize_params { image = "debian-cloud/debian-11" }
  }

  network_interface {
    network = "default" # Critical: no access_config block -> no public IP
  }
}

Other

1In Google Cloud Console, go to Compute Engine > VM instances
2Click the VM name
3Click Edit
4Under Network interfaces, set External IP to None
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_public_ip(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"VM Instance {instance.name} does not have a public IP."
            )
            if instance.public_ip:
                report.status = "FAIL"
                report.status_extended = f"VM Instance {instance.name} has a public IP."
            findings.append(report)

        return findings

References