# Ensure VM Instance Has a Single Network Interface

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888301356403-ensure-vm-instance-has-a-single-network-interface
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Compute Engine VM instances are configured with a single network interface (NIC), rather than multiple NICs connecting the instance to more than one VPC network, unless a documented and approved architectural reason requires multiple interfaces.

**Rationale**

An instance with multiple network interfaces spanning different VPC networks can act as a bridge between those networks, potentially allowing traffic to traverse network boundaries that were intended to remain segmented, and bypassing firewall rules and routing controls designed around single-network assumptions. Restricting instances to a single network interface reduces the risk of unintended network bridging and simplifies network security review.

**Impact**

-   Reduces the risk of an instance being used (intentionally or via compromise) to bridge otherwise segmented networks
    
-   Simplifies firewall rule and routing analysis for the instance
    
-   May require architectural review for legitimate multi-NIC use cases, such as dedicated network appliances
    

**Default Value**

By default, a newly created VM instance has a single network interface unless additional interfaces are explicitly added at creation time.

**Pre-Requisites**

-   IAM permissions to view Compute Engine instance network configuration (e.g., Compute Viewer)
    
-   A documented list of any approved exceptions requiring multiple network interfaces (for example, network virtual appliances)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the instance to review.
    
4.  Open the instance details and review the Network interfaces section.
    
5.  Verify that only one network interface is listed, unless the instance is a documented, approved exception.
    
6.  If an instance has multiple network interfaces without documented approval, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and identify the instance with multiple network interfaces.
    
4.  Note that network interfaces generally cannot be added or removed on a running or existing instance; this typically requires creating a replacement instance.
    
5.  Create a new instance with a single network interface on the appropriate VPC network and subnet, matching the required configuration.
    
6.  Migrate the workload and any necessary data to the new single-NIC instance, verifying connectivity and functionality.
    
7.  Delete the original multi-NIC instance once the migration is verified.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances.
    
4.  Create a new instance with the additional network interface(s) required, following the same replacement process described above.
    
5.  Migrate the workload to the new multi-NIC instance and verify functionality.
    
6.  Delete the single-NIC instance once the migration is verified.
    

**Reference**

-   [https://cloud.google.com/vpc/docs/create-use-multiple-interfaces](https://cloud.google.com/vpc/docs/create-use-multiple-interfaces)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.