Firewall rules should prohibit ingress from 0.0.0.0/0 to any port
Checks `google_compute_firewall` rules for unrestricted ingress. Checkov CKV2_GCP_12 looks for access to all ports. KICS looks for RDP access (port 3389) and SSH access (port 22) not restricted from the Internet.
Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block) to ensure the principle of least privileges.
What this control checks
google_compute_firewall must not allow unrestricted ingress access to all ports from 0.0.0.0/0
Common pitfalls
Check passes when disabled or EGRESS
The check passes if disabled equals true. The check passes if direction equals EGRESS.
Audit evidence
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_GCP_12; KICS queries "RDP Access Is Not Restricted" (678fd659-96f2-454a-a2a0-c2571f83a4a3) and "SSH Access Is Not Restricted" (c4dcdcdf-10dd-4bf4-b4a0-8f6239e6aaa0).
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to DNS port 53
- Firewall rules should prohibit ingress from 0.0.0.0/0 to SMTP port 25
- Firewall rules should prohibit ingress from 0.0.0.0/0 to PostgreSQL port 5432
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 27017-27019
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_restrict_ingress_all - Checkov Check:
CKV2_GCP_12 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_restrict_ingress_all - KICS Queries:
678fd659-96f2-454a-a2a0-c2571f83a4a3,c4dcdcdf-10dd-4bf4-b4a0-8f6239e6aaa0
Last reviewed: 2026-10-09