Ensure legacy networks do not exist for a project

This product is not supported for your selected Datadog site. ().
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Metadata

Id: 550e8400-e29b-41d4-a716-446655440000

Cloud Provider: GCP

Platform: Terraform

Severity: High

Category: Networking and Firewall

Learn More

Description

Legacy networks in Google Cloud Platform (GCP) with auto_create_subnetworks enabled represent a significant security risk as they automatically create subnets with predefined IP ranges in every region. This can lead to overly permissive network configurations and potentially expose internal services to unauthorized access or lateral movement within your infrastructure.

The secure configuration (as shown below) explicitly avoids enabling auto-created subnetworks, giving administrators complete control over subnet creation and IP addressing:

resource "google_compute_network" "legacy_network_2" {
  name = "legacy-network"
}

Insecure configuration example with auto_create_subnetworks enabled:

resource "google_compute_network" "legacy_network" {
  name                    = "legacy-network"
  auto_create_subnetworks = true
}

Compliant Code Examples

resource "google_compute_network" "modern_network" {
  name                    = "modern-network"
  auto_create_subnetworks = false
}

Non-Compliant Code Examples

resource "google_compute_network" "legacy_network" {
  name                    = "legacy-network"
  auto_create_subnetworks = true
}