Back to Checks
gcp

VM instance has a single network interface

compute_instance_single_network_interface
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:compute.googleapis.com/Instance

VM instances should be configured with only one network interface unless multiple interfaces are explicitly required for complex network configurations.

Multiple network interfaces expand the attack surface and create additional network pathways that may be exploited.

Prowler logoProwlerprowler-provider-gcp

Risk

Multiple network interfaces on a VM instance can:

  • Expand attack surface by providing additional entry points for unauthorized access
  • Create unintended network paths that bypass security controls
  • Increase management complexity leading to potential misconfigurations

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_single_network_interface

Recommendation

Configure VM instances with only the minimum network connectivity required for their intended purpose. Review instances with multiple network interfaces and consolidate to a single interface unless multi-NIC configuration is explicitly required for network appliance or routing purposes.

Remediation

Terraform

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  # Only one network interface
  network_interface {
    network = "default"
  }
}

Other

1Create a machine image from the non-compliant VM instance
2Create a new VM instance from the machine image with only one network interface
3Verify the new instance is functioning correctly
4Delete the original multi-interface instance

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_single_network_interface(Check):
    """
    Ensure that VM instances have a single network interface.

    This check evaluates whether Compute Engine instances are configured with only
    one network interface to minimize network complexity and reduce attack surface.
    - PASS: The VM instance has a single network interface.
    - MANUAL: The VM instance is a GKE-managed instance with multiple network interfaces
              (manual review recommended as these may legitimately require multiple interfaces).
    - FAIL: The VM instance has multiple network interfaces (excluding GKE instances).
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"

            interface_names = [nic.name for nic in instance.network_interfaces]
            interface_count = len(instance.network_interfaces)

            if interface_count == 1:
                report.status_extended = f"VM Instance {instance.name} has a single network interface: {interface_names[0]}."
            elif interface_count > 1:
                # GKE instances may legitimately require multiple network interfaces
                if instance.name.startswith("gke-"):
                    report.status = "MANUAL"
                    report.status_extended = f"VM Instance {instance.name} has {interface_count} network interfaces: {', '.join(interface_names)}. This is a GKE-managed instance which may legitimately require multiple interfaces. Manual review recommended."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"VM Instance {instance.name} has {interface_count} network interfaces: {', '.join(interface_names)}."
            else:
                report.status_extended = (
                    f"VM Instance {instance.name} has no network interfaces."
                )

            findings.append(report)

        return findings

References