Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules should prohibit unrestricted SSH access from the internet
Google Firewall should not allow SSH access (port 22) from the Internet (public CIDR block). Prowler identifies VPC firewall rules allowing Internet-sourced ingress (`0.0.0.0/0`) to TCP port 22 (SSH).
What this control checks
Firewall rules should prohibit unrestricted SSH access from the internet
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
5 more clauses
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
- A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
- A3.4.1: Logical access to the cardholder data environment is controlled and managed.
- A.8.20 Network security
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
- CA-9 Internal System Connections
- SC-7: Boundary Protection
- 3.6 Ensure That SSH Access Is Restricted From the Internet
- 3.6 Ensure That SSH Access Is Restricted From the Internet
- AM-12.01AC Policies and instructions for endpoint devices and removable storage media shall furthermore contain the following aspects: - Managed endpoints are configured with appropriate software firewalls;- Managed endpoints are configured with Data Loss Prevention (DLP) technologies and rules...
- COS-04.01B Each network perimeter is controlled by security gateways. The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
5 more clauses
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
- PI-01.01AC The cloud service provider sets up an application firewall to protect the administration interfaces for cloud service customers that are accessible over public networks.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.6 GCP `Firewall Rules` are specific to a `VPC Network`. Each rule either `allows` or `denies` traffic when its conditions are met. Its conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses,...
- 164.308(a)(1)(ii)(B) Risk management
- 164.310(a)(1) Facility access controls
- 164.312(e)(1) Transmission security
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit unrestricted RDP access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to Oracle DB port 1521
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 8888
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 6379
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP port 636
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_firewall_rule_ssh_world_open - Powerpipe Control:
gcp_compliance.control.restrict_firewall_rule_ssh_world_open - Prowler Check:
compute_firewall_ssh_access_from_the_internet_allowed - KICS Query:
c4dcdcdf-10dd-4bf4-b4a0-8f6239e6aaa0
Last reviewed: 2026-10-10