Back to Checks
stackit

IaaS servers do not have public IP addresses directly attached

iaas_server_public_ip_attached
Service: iaasSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Servers should not have public IP addresses directly attached to their network interfaces unless strictly required. A public IP exposes the server to inbound traffic from the internet on all ports not blocked by a security group, increasing the attack surface.

Prowler logoProwlerprowler-provider-stackit

Risk

Direct internet exposure. A server with a directly attached public IP can be reached from the internet. If its security groups allow broad inbound traffic, this exposure can enable unauthorized access, data exfiltration, or server compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler stackit --checks iaas_server_public_ip_attached

Recommendation

Remove direct public exposure. Detach the public IP from the server network interface unless it is strictly required. Route internet-facing workloads through a load balancer, and use a bastion host or VPN for administrative access.

Remediation

Other

1In the StackIT Portal open Networking > Public IPs and identify the IP attached to the affected server's network interface. 2. Detach the public IP from the server. 3. Use a load balancer for internet-facing workloads or a bastion host / VPN for administrative access. 4. Re-run Prowler to confirm the finding is resolved.

Check Code

from prowler.lib.check.models import Check, CheckReportStackIT
from prowler.providers.stackit.services.iaas.iaas_client import iaas_client


class iaas_server_public_ip_attached(Check):
    """
    Check if IaaS servers have public IP addresses directly attached.

    This check verifies that servers do not have a public IP address
    directly attached to their network interfaces, which would expose
    them to inbound traffic from the internet.
    """

    def execute(self):
        """
        Execute the check for all servers in the StackIT project.

        Returns:
            list: A list of CheckReportStackIT findings
        """
        findings = []

        for server in iaas_client.servers:
            report = CheckReportStackIT(
                metadata=self.metadata(),
                resource=server,
            )

            if server.has_public_ip:
                report.status = "FAIL"
                report.status_extended = (
                    f"Server {server.name} has a public IP address directly attached, "
                    f"exposing it to the internet."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Server {server.name} does not have a public IP address attached."
                )

            findings.append(report)

        return findings

References