Back to Checks
gcp

VPC network is not legacy

compute_network_not_legacy
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:compute.googleapis.com/Network

Google Cloud networks are evaluated for legacy mode (subnet_mode: legacy). The finding highlights networks using the older, non-subnetted design instead of VPC with regional subnets.

Prowler logoProwlerprowler-provider-gcp

Risk

Legacy networks lack subnets, peering, and private access. This reduces isolation and forces public IP paths, weakening confidentiality and enabling lateral movement/data exfiltration. Coarse controls and routing limits threaten integrity. A single global range and gateway create contention that can degrade availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_network_not_legacy

Recommendation

Decommission legacy networks. Migrate to custom-mode VPCs with regional subnets and granular firewall policies. Apply least privilege segmentation, enable private access and Cloud NAT to avoid public exposure, and use peering or private connectivity for dependencies. Plan and test migration to limit downtime.

Remediation

CLI

gcloud beta compute networks update <LEGACY_NETWORK_NAME> --switch-to-custom-subnet-mode

Other

1In Google Cloud Console, go to Networking > VPC network > VPC networks
2Find the network with Subnet creation mode showing Legacy
3Select it and click Delete VPC network
4Type the network name to confirm and click Delete

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_network_not_legacy(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for network in compute_client.networks:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=network,
                location=compute_client.region,
            )
            report.status = "PASS"
            report.status_extended = f"Network {network.name} is not legacy."
            if network.subnet_mode == "legacy":
                report.status = "FAIL"
                report.status_extended = f"Legacy network {network.name} exists."
            findings.append(report)

        return findings

References