Description:

Internet-facing cloud instances are virtual machines (VMs) that are directly accessible from the public internet through a public IP address. Unless explicitly required for hosting public-facing applications or services, cloud instances should not be exposed to the internet. Restricting public access helps reduce the attack surface and improves the security of cloud workloads.


Rationale:

Cloud instances that are publicly accessible are more vulnerable to unauthorized access, brute-force attacks, vulnerability exploitation, and other internet-based threats. Ensuring that only authorized cloud instances are accessible from the internet helps protect applications and sensitive data.


Impact:

  • Removing public internet access may prevent external users from directly connecting to the cloud instance.

  • Applications that require public access should use secure alternatives such as load balancers, VPNs, or bastion hosts.

  • Verify application connectivity before removing public internet access.


Default Value:

By default, Utho allows cloud instances to be created with or without a Public IPv4 Address. Administrators should ensure that only authorized cloud instances are assigned a Public IPv4 Address.


Pre-requisites:

  • A Utho account with permission to manage cloud instances.

  • Access to the Utho Console.

  • Permission to modify network settings for cloud instances.


Remediation

Test Plan:

Using the Utho Console

  1. Sign in to the Utho Console using an account with appropriate permissions.

  2. Navigate to Compute → Cloud Instances.

  3. Locate the cloud instance that you want to verify.

  4. Click Manage for the selected cloud instance.

  5. Click the Network tab.

  6. Review the Network Configuration section.

  7. Verify that the Public IPv4 Address is not enabled or not assigned.

  1. If the Public IPv4 Address is enabled or assigned for a cloud instance that does not require internet access, follow the Implementation Steps to remediate the issue.


Using the Utho API

Retrieve the network configuration of the cloud instance.


curl -s -H "Authorization: Bearer $UTHO_API_TOKEN" \

https://api.utho.com/v2/cloud/<instance-id>



Verify that the cloud instance does not have a Public IPv4 Address assigned.


Implementation Steps:

Using the Utho Console

  1. Sign in to the Utho Console using an account with appropriate permissions.

  2. Navigate to Compute → Cloud Instances.

                            

  1. Locate the cloud instance for which public internet access needs to be removed.

  2. Click Manage for the selected cloud instance.

  1. Click the Network tab.

  2. Click Manage under the Network Configuration section.

  3. Disable or remove the Public IPv4 Address from the cloud instance.

  1. Save the configuration changes.



Using the Utho API

Update the network configuration of the cloud instance.


curl -X PUT \

-H "Authorization: Bearer $UTHO_API_TOKEN" \

-H "Content-Type: application/json" \

-d '{"public_ip":false}' \

https://api.utho.com/v2/cloud/<instance-id>



Verify that the cloud instance no longer has a Public IPv4 Address assigned.


Backout Plan:

  1. Sign in to the Utho Console using an account with appropriate permissions.

  2. Navigate to Compute → Cloud Instances.

  3. Locate the affected cloud instance.

  4. Click Manage for the selected cloud instance.

  5. Click the Network tab.

  6. Click Manage under the Network Configuration section.

  7. Re-enable or assign a Public IPv4 Address if public internet access is required.

  8. Save the configuration changes.


References: