---
title: Vulnerable compute instance is publicly reachable and can access a crown jewel
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Vulnerable compute instance is publicly
  reachable and can access a crown jewel
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Vulnerable compute instance is publicly reachable and can access a crown jewel

## Description{% #description %}

A publicly accessible Compute Engine instance has an open, high or critical severity vulnerability with a network attack vector (CVSS AV:N) and assumes a service account that can read a crown jewel Cloud Storage bucket. An attacker who compromises the instance from the internet by exploiting this vulnerability could use the attached service account's credentials to read data from a business-critical bucket, leading to data exfiltration or leakage.

## Remediation{% #remediation %}

1. Review and apply security patches for the vulnerability. If no patch is available, apply compensating controls such as disabling or removal of the vulnerable component.
1. Assess whether this instance needs to be accessible from the internet. If not, restrict access by updating firewall rules to only allow traffic from trusted sources. See [VPC firewall rules](https://cloud.google.com/firewall/docs/firewalls) for guidance.
1. Restrict the service account's permissions on the bucket by reviewing IAM policy bindings and applying least privilege. See [Using IAM permissions for Cloud Storage](https://cloud.google.com/storage/docs/access-control/iam) for more information.