---
title: Compute instances should only have internal IP addresses
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Compute instances should only have
  internal IP addresses
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Compute instances should only have internal IP addresses
 
## Description{% #description %}

This rule fails when any network interface on an instance has an external IPv4 address (an `accessConfigs` entry) or an external IPv6 range (an `ipv6AccessConfigs` entry). A public address exposes the instance directly to the internet. Place instances behind a load balancer instead, and use Cloud NAT for outbound traffic and Identity-Aware Proxy for administrative access.

An IPv4 access config fails even without a `natIP`, which is how a stopped instance with an ephemeral external address is reported. The CIS audit text names only `accessConfigs`. This rule also fails external IPv6 because it is publicly routable in the same way. Interfaces with only internal IPv4 or internal IPv6 addresses pass. GKE nodes, identified by a name starting with `gke-` together with a non-empty `goog-k8s-cluster-name` label, are skipped because GKE manages their addresses.

## Remediation{% #remediation %}

1. Remove each external IPv4 address from the instance, following [Unassign an external IP address](https://docs.cloud.google.com/compute/docs/ip-addresses/configure-static-external-ip-address#unassign_ip).
1. Remove external IPv6 by changing the interface stack type to `IPV4_ONLY`, following [Change the stack type of an instance](https://docs.cloud.google.com/compute/docs/ip-addresses/configure-ipv6-address#update-vm-stacktype), or move the interface to a subnet that uses internal IPv6.
1. Prevent new external addresses with the `constraints/compute.vmExternalIpAccess` and `constraints/compute.disableVpcExternalIpv6` [organization policy constraints](https://docs.cloud.google.com/organization-policy/reference/org-policy-constraints).

## References{% #references %}

- [IP addresses](https://docs.cloud.google.com/compute/docs/ip-addresses)
- [Configure IPv6 for instances](https://docs.cloud.google.com/compute/docs/ip-addresses/configure-ipv6-address#update-vm-stacktype)
- [Restrict external IP addresses to specific instances](https://docs.cloud.google.com/compute/docs/ip-addresses/configure-static-external-ip-address#disableexternalip)
- [CIS Google Cloud Platform Foundation Benchmark](https://www.cisecurity.org/benchmark/google_cloud_computing_platform)