Subnetworks must have Private Google Access enabled so VM instances with only internal IPs can reach Google APIs and services over Google’s internal network. Without Private Google Access, operators may assign external IPs or route traffic over the public internet, increasing attack surface and the risk of data exposure or network-based attacks.
For Ansible resources using the google.cloud.gcp_compute_subnetwork or gcp_compute_subnetwork modules, the private_ip_google_access property must be defined and set to yes. Tasks missing this property or with private_ip_google_access not equal to yes are flagged.
Secure Ansible example:
- name:Create subnetwork with Private Google Access enabledgoogle.cloud.gcp_compute_subnetwork:name:my-subnetregion:us-central1ip_cidr_range:10.0.0.0/24network:my-vpcprivate_ip_google_access:yes
Compliant Code Examples
- name:create a subnetwork3google.cloud.gcp_compute_subnetwork:name:ansiblenetregion:us-west1network:"{{ network }}"ip_cidr_range:172.16.0.0/16project:test_projectauth_kind:serviceaccountservice_account_file:"/tmp/auth.pem"private_ip_google_access:yesstate:present
Non-Compliant Code Examples
- name:create a subnetwork2google.cloud.gcp_compute_subnetwork:name:ansiblenetregion:us-west1network:"{{ network }}"ip_cidr_range:172.16.0.0/16project:test_projectauth_kind:serviceaccountservice_account_file:"/tmp/auth.pem"private_ip_google_access:nostate:present
- name:create a subnetworkgoogle.cloud.gcp_compute_subnetwork:name:ansiblenetregion:us-west1network:"{{ network }}"ip_cidr_range:172.16.0.0/16project:test_projectauth_kind:serviceaccountservice_account_file:"/tmp/auth.pem"state:present
1
2
rulesets:- Ansible / GCP # Rules to enforce / GCP.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
