Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have IP forwarding disabled
Instances must not have IP forwarding enabled, which means the attribute `can_ip_forward` must not be true. Disabling IP forwarding ensures the instance can only receive packets addressed to the instance.
What this control checks
can_ip_forward must not be true on Compute Engine instances (gke- instances excluded).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 1.4.5 The disclosure of internal IP addresses and routing information is limited to only authorized parties
- CA-9 Internal System Connections
- SC-7: Boundary Protection
- 4.6 Ensure That IP Forwarding Is Not Enabled on Instances
- 4.6 Ensure That IP Forwarding Is Not Enabled on Instances
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- 4.6 Ensure that IP forwarding is not enabled on Instances
- 4.6 Ensure that IP forwarding is not enabled on Instances
- 4.6 Ensure that IP forwarding is not enabled on Instances
Related controls
- Compute Engine instance templates should have IP forwarding disabled
- Compute Engine instances should have a single network interface
- Compute Engine instances should have deletion protection enabled
- Compute Engine instances should have high-level basic roles restricted
- Firewall rules should prohibit unrestricted SSH access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_ip_forwarding_disabled - Checkov Check:
CKV_GCP_36 - Powerpipe Control:
gcp_compliance.control.compute_instance_ip_forwarding_disabled - Prowler Check:
compute_instance_ip_forwarding_is_enabled - KICS Query:
f34c0c25-47b4-41eb-9c79-249b4dd47b89 - Trivy Check:
GCP-0043
Last reviewed: 2026-10-09