GKE cluster subnetworks should all have Private Google Access enabled
Checkov CKV_GCP_74, titled "Ensure that private_ip_google_access is enabled for Subnet", inspects the `private_ip_google_access` key on each `google_compute_subnetwork` resource to check whether Private Google Access is enabled.
What this control checks
google_compute_subnetwork must have private_ip_google_access enabled.
Common pitfalls
Some subnetwork purposes are not supported
private_ip_google_access is not supported for subnetworks with the following purpose set: INTERNAL_HTTPS_LOAD_BALANCER, REGIONAL_MANAGED_PROXY, GLOBAL_MANAGED_PROXY.
Audit evidence
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_74.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.).
Framework mappings
The clauses this control is mapped to in each framework.
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_subnetwork_private_ip_google_access_enabled - Checkov Check:
CKV_GCP_74 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_subnetwork_private_ip_google_access_enabled
Last reviewed: 2026-10-09