Back to Checks
gcp

Project does not have a default VPC network

compute_network_default_in_use
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:compute.googleapis.com/Network

Projects are assessed for a VPC network named default (the pre-created, auto-mode network).

Prowler logoProwlerprowler-provider-gcp

Risk

Using the default VPC can weaken segmentation and expose services via permissive firewall rules (e.g., broad internal trust or public admin ports). This increases likelihood of unauthorized access, lateral movement, and data exfiltration, impacting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_network_default_in_use

Recommendation

Prefer custom VPCs over default. Remove unused default networks and apply least privilege with explicit firewall rules, private connectivity, and workload-based segmentation. Enforce creation controls (e.g., org policy to skip default network) and use defense in depth with logging and monitoring.

Remediation

CLI

gcloud compute networks delete default --quiet

Terraform

# Deletes the default VPC network to pass the check
resource "google_project_default_network" "<example_resource_name>" {}  # Ensures the 'default' network is removed

Other

1In Google Cloud Console, go to Networking > VPC network > VPC networks
2Select the network named "default"
3Click Delete VPC network and confirm
4If deletion is blocked, remove or migrate any resources using the "default" network, then retry Delete

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_network_default_in_use(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        projects_with_default_network = {}

        # Identify projects with the default network
        for network in compute_client.networks:
            if network.name == "default":
                projects_with_default_network[network.project_id] = network

        # Generate reports for all projects
        for project in compute_client.project_ids:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=compute_client.projects[project],
                project_id=project,
                resource_id="default",
                resource_name="default",
                location=compute_client.region,
            )
            if project in projects_with_default_network:
                report.status = "FAIL"
                report.status_extended = (
                    f"Default network is in use in project {project}."
                )
                report.resource = projects_with_default_network[project]
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Default network does not exist in project {project}."
                )

            findings.append(report)

        return findings

References