Description

Ensure that Compute Engine VM instances are configured with a single network interface (NIC), rather than multiple NICs connecting the instance to more than one VPC network, unless a documented and approved architectural reason requires multiple interfaces.

Rationale

An instance with multiple network interfaces spanning different VPC networks can act as a bridge between those networks, potentially allowing traffic to traverse network boundaries that were intended to remain segmented, and bypassing firewall rules and routing controls designed around single-network assumptions. Restricting instances to a single network interface reduces the risk of unintended network bridging and simplifies network security review.

Impact

  • Reduces the risk of an instance being used (intentionally or via compromise) to bridge otherwise segmented networks

  • Simplifies firewall rule and routing analysis for the instance

  • May require architectural review for legitimate multi-NIC use cases, such as dedicated network appliances

Default Value

By default, a newly created VM instance has a single network interface unless additional interfaces are explicitly added at creation time.

Pre-Requisites

  • IAM permissions to view Compute Engine instance network configuration (e.g., Compute Viewer)

  • A documented list of any approved exceptions requiring multiple network interfaces (for example, network virtual appliances)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the instance to review.

  4. Open the instance details and review the Network interfaces section.

  5. Verify that only one network interface is listed, unless the instance is a documented, approved exception.

  6. If an instance has multiple network interfaces without documented approval, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and identify the instance with multiple network interfaces.

  4. Note that network interfaces generally cannot be added or removed on a running or existing instance; this typically requires creating a replacement instance.

  5. Create a new instance with a single network interface on the appropriate VPC network and subnet, matching the required configuration.

  6. Migrate the workload and any necessary data to the new single-NIC instance, verifying connectivity and functionality.

  7. Delete the original multi-NIC instance once the migration is verified.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances.

  4. Create a new instance with the additional network interface(s) required, following the same replacement process described above.

  5. Migrate the workload to the new multi-NIC instance and verify functionality.

  6. Delete the single-NIC instance once the migration is verified.

Reference