Review GCP SSH ingress access scope

Description

Allowing inbound TCP 22 from all addresses can expose SSH services to unnecessary connection attempts. Actual connectivity also depends on target VMs, network paths, other firewall policies and a listening SSH service.

SSH is an administrative path. Restrict it through approved management networks or bastion hosts rather than leaving it open to the public internet.

Potential impact

Services can become targets for external scanning and password guessing.
Compromised credentials or weaknesses in authentication or service controls can lead to server compromise.

Remediation

Remove 0.0.0.0/0 and unnecessary all IPv6 access to TCP 22, allowing only approved management sources and targets.
Prepare the required VPN, bastion or IAP path first. Consider OS Login and appropriate multi-factor authentication, and test that required connections succeed while unwanted connections are blocked.

Examples

Replace 10.10.0.0/24 with the actual approved management range and establish connectivity from it. Both examples omit target tags, so separately verify that the rule applies only to the VMs that need it.

Before

hcl

resource "google_compute_firewall" "ssh" {
  name          = "public-ssh"
  network       = google_compute_network.default.name
  direction     = "INGRESS"
  source_ranges = ["0.0.0.0/0"]

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }
}

After

hcl

resource "google_compute_firewall" "ssh" {
  name          = "restricted-ssh"
  network       = google_compute_network.default.name
  direction     = "INGRESS"
  source_ranges = ["10.10.0.0/24"]

  allow {
    protocol = "tcp"
    ports    = ["22"]
  }
}

Explanation:

Before: TCP 22 is allowed from all IPv4 sources.
After: The source range is restricted. Check that other rules do not restore unwanted access and verify actual SSH authentication.