# Ensure Compute Instances Do Not Have Public IP Addresses (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233829-ensure-compute-instances-do-not-have-public-ip-addresses-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 2 Description: Compute instances should not have external (public) IP addresses to reduce exposure to the internet. Instead, instances should operate behind load balancers, which provide a controlled and secure way to access these resources. Rationale: Public IP addresses increase the attack surface of Compute instances by exposing them directly to the internet. By restricting instances to private IPs and routing traffic through load balancers or Identity-Aware Proxy (IAP), organizations can enforce tighter access controls and reduce the risk of unauthorized access or exploitation. Impact: Removing external IP addresses from Compute instances may disrupt applications or services relying on direct public access. Proper networking configurations, such as VPNs, IAP, or bastion hosts, should be in place to avoid service interruptions. Default Value: By default, Compute instances are assigned public IP addresses unless explicitly configured otherwise. Audit Steps: Using Google Cloud Console: 1. Navigate to Compute Engine > VM Instances: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).              ![](https://support.icompaas.com/assets/kb/5351edfaab27879b.png) 2. For each instance, verify that no External IP is configured under the Network interfaces section.              ![](https://support.icompaas.com/assets/kb/e5a82dd6782d4d18.png) #### Using Google Cloud CLI: List all instances: gcloud compute instances list --format=json 1. Review the networkInterfaces section in the output: - Ensure no accessConfigs section contains natIP. Example output for a public IP: networkInterfaces: \- accessConfigs:   - name: External NAT     natIP: 130.211.181.55     type: ONE\_TO\_ONE\_NAT 2. If the natIP field is present, the instance has a public IP. Remediation Steps: #### Using Google Cloud Console: 1. Navigate to Compute Engine > VM Instances: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                ![](https://support.icompaas.com/assets/kb/9a1fffdda52316a4.png) 2. Select the instance name to open its Instance Details page. ![](https://support.icompaas.com/assets/kb/51e07b9293c31173.png) 3. Click Edit. ![](https://support.icompaas.com/assets/kb/d5cbf4aded082ae2.png) 4. Under Network interfaces, set External IP to None for each network interface.                    ![](https://support.icompaas.com/assets/kb/67963c3212681c2f.png) 5. Save the changes.          ![](https://support.icompaas.com/assets/kb/2d7e353f442b2a50.png) #### Using Google Cloud CLI: Describe the instance: gcloud compute instances describe --zone= 1. Identify the accessConfigs section containing the external IP. Remove the external IP: gcloud compute instances delete-access-config --zone= --access-config-name 2. Replace  with the name of the access configuration, such as External NAT. Prevention: To ensure that new VMs are not configured with public IPs, apply an Organization Policy to restrict external IP access: - [Define Allowed External IPs Policy](https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess). ### **Backout Plan:** If an instance needs to be publicly accessible, or if an error occurs after removing the public IP: 1. Identify the affected instance. 2. Re-enable the Auto-assign Public IP setting at the time of launch or use the following command to assign a public IP manually: aws ec2 associate-address --instance-id --public-ip 3. Verify that the instance is correctly reconfigured with the public IP. References: 1. [Connecting to Instances Without Public IPs](https://cloud.google.com/compute/docs/instances/connectingadvanced#sshbetweeninstances) Additional Information: - Use Identity-Aware Proxy (IAP) to access Linux VMs without public IPs. - For Windows VMs, configure RDP access through private networking or a bastion host. CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.3 Configure Data Access Control Lists

Apply access permissions to restrict data access to authorized users only.

✅

✅

✅

14.6 Protect Information Through Access Control Lists

Enforce access controls on files, databases, and systems to restrict unauthorized access.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.