---
title: Compute instances should only have internal IP addresses
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Compute instances should only have
  internal IP addresses
---

# Compute instances should only have internal IP addresses
 
## Description{% #description %}

Compute instances should not be configured to have external IP addresses.

## Rationale{% #rationale %}

To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.

You can connect to Linux VMs that do not have public IP addresses by using Identity-Aware Proxy for TCP forwarding. Learn more at [https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances](https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances).

For Windows VMs, see [https://cloud.google.com/compute/docs/instances/connecting-to-instance](https://cloud.google.com/compute/docs/instances/connecting-to-instance).

### Impact{% #impact %}

Removing the external IP address from your Compute instance may cause some applications to stop working.

### Prevention{% #prevention %}

You can configure the "Define allowed external IPs for VM instances" organization policy to prevent VMs from being configured with public IP addresses. Learn more at: [https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address)

### Exception{% #exception %}

Instances created by GKE should be excluded because some of them have external IP addresses and cannot be changed by editing the instance settings. Instances created by GKE should be excluded. These instances have names that start with "gke-" and are labeled "goog-gke-node".

## Remediation{% #remediation %}

### From the console{% #from-the-console %}

1. Go to the VM instances page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).
1. Click on the instance name to go the the Instance detail page.
1. Click **Edit**.
1. For each Network interface, ensure that **External IP** is set to None.
1. Click **Done** and then click **Save**.

### From the command line{% #from-the-command-line %}

1. Describe the instance properties:

   ```
   gcloud compute instances describe <INSTANCE_NAME> --zone=<ZONE>
   ```

1. Identify the access config name that contains the external IP address. This access config appears in the following format:

   ```
   networkInterfaces:
   - accessConfigs:
    - kind: compute#accessConfig
      name: External NAT
      natIP: 130.211.181.55
      type: ONE_TO_ONE_NAT
   ```

1. Delete the access config:

   ```
   gcloud compute instances delete-access-config <INSTANCE_NAME> --zone=<ZONE> --access-config-name <ACCESS_CONFIG_NAME>
   ```

In the above example, the `ACCESS_CONFIG_NAME` is `External NAT`. The name of your access config might be different.

## References{% #references %}

1. [https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses](https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses)
1. [https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances](https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances)
1. [https://cloud.google.com/compute/docs/instances/connecting-to-instance](https://cloud.google.com/compute/docs/instances/connecting-to-instance)
1. [https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip)
1. [https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints](https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints)