Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules should prohibit ingress from 0.0.0.0/0 to any port
Checks `google_compute_firewall` rules for unrestricted ingress. Checkov CKV2_GCP_12 looks for access to all ports. KICS looks for RDP access (port 3389) and SSH access (port 22) not restricted from the Internet.
What this control checks
google_compute_firewall must not allow unrestricted ingress access to all ports from 0.0.0.0/0
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to DNS port 53
- Firewall rules should prohibit ingress from 0.0.0.0/0 to SMTP port 25
- Firewall rules should prohibit ingress from 0.0.0.0/0 to PostgreSQL port 5432
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 27017-27019
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_restrict_ingress_all - Checkov Check:
CKV2_GCP_12 - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_restrict_ingress_all - KICS Queries:
678fd659-96f2-454a-a2a0-c2571f83a4a3,c4dcdcdf-10dd-4bf4-b4a0-8f6239e6aaa0
Last reviewed: 2026-10-09