Severity Framework
CCSS (Common Configuration Scoring System) is a set of measures used to determine the severity of the rule.
Snyk CCSS
Rule category
Each rule is associated with a high-level category. For example IAM, Container, Monitoring, Logging, Network, etc.
Network/ Security
Is your environment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-ControlsCSA-CCMISO-27001NIST-800-53
- Snyk IDSNYK-CC-00396
- creditSnyk Research Team
Description
Instance template allows sending and receiving of packets from non-matching source or destination IPs, meaning it is vulnerable to attack.
How to fix?
Set can_ip_forward to false. Instance template allows sending and receiving of packets from non-matching source or destination IPs, meaning it is vulnerable to attack.
Example Configuration
resource "google_compute_instance_template" "allowed1" {
name = "appserver-template-396a1"
description = "This template is used to create app server instances."
machine_type = "e2-medium"
can_ip_forward = false
disk {
source_image = "debian-cloud/debian-11"
auto_delete = true
boot = true
}
network_interface {
network = "default"
}
}