Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules should prohibit unrestricted TCP/UDP access from the internet to all ports
Checks for open firewall rules allowing TCP/UDP from the internet. The KICS check RDP Access Is Not Restricted checks if the Google compute firewall allows unrestricted RDP access. Allowed ports should not contain RDP port 3389.
What this control checks
Allowed ports in firewall rules must not include RDP port 3389
Framework mappings
The clauses this control is mapped to in each framework.
- Restrict inbound and outbound traffic to that which is necessary for the cardholder data environment, and specifically deny all other traffic
Related controls
- Firewall rules should prohibit unrestricted SSH access from the internet
- Firewall rules should prohibit ingress from 0.0.0.0/0 to POP3 port 110
- Firewall rules should prohibit ingress from 0.0.0.0/0 to NetBIOS session port 139
- Firewall rules should prohibit ingress from 0.0.0.0/0 to TCP ports 27017-27019
- Projects should have log metric filters and alerts configured for VPC Network Firewall rule changes
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
restrict_firewall_rule_world_open_tcp_udp_all_ports - Powerpipe Controls:
gcp_compliance.control.restrict_firewall_rule_rdp_world_open,gcp_compliance.control.restrict_firewall_rule_world_open_tcp_udp_all_ports - KICS Query:
678fd659-96f2-454a-a2a0-c2571f83a4a3
Last reviewed: 2026-10-10