Firewall rules should prohibit ingress from 0.0.0.0/0 to PostgreSQL port 5432
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. The powerpipe check is titled "Ensure no open firewall rules allow ingress from 0.0.0.0/0 to PostgreSQL port 5432".
Firewall rules provide stateful filtering of ingress/egress network traffic to GCP resources. It is recommended that no security group allows unrestricted ingress access to PostgreSQL port 5432.
What this control checks
Firewall rules should prohibit ingress from 0.0.0.0/0 to PostgreSQL port 5432
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_postgresql_port_5432.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_ingress_access_restricted_to_postgresql_port_5432 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_ingress_access_restricted_to_postgresql_port_5432
Last reviewed: 2026-10-09