Compute Engine instance templates should have IP forwarding disabled
Compute Engine instance templates should have IP forwarding disabled. The Powerpipe check is titled "Compute Instance template IP forwarding should be disabled".
Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet.
What this control checks
Compute Instance template IP forwarding should be disabled
Common pitfalls
Routing needs both capabilities
However, both capabilities are required if you want to use instances to help route packets.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_instance_template_ip_forwarding_disabled.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_template_ip_forwarding_disabled - Powerpipe Control:
gcp_compliance.control.compute_instance_template_ip_forwarding_disabled
Last reviewed: 2026-10-09