Policy: GCP > CIS v1 > 4 Virtual Machines > 4.05 Ensure that IP forwarding is not enabled on Instances (Not Scored)

Configures auditing against a CIS Benchmark item.

Level: 1 (Not Scored)

Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance. Similarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet. However, both capabilities are required if you want to use instances to help route packets. Forwarding of data packets should be disabled to prevent data loss or information disclosure.

Targets

This policy targets the following resource types:

GCP > Compute Engine > Instance

Primary Policy

This policy is used with the following primary policy:

GCP > CIS v1 > 4 Virtual Machines

Controls

Setting this policy configures this control:

GCP > CIS v1 > 4 Virtual Machines > 4.05 Ensure that IP forwarding is not enabled on Instances (Not Scored)

Policy Specification

Schema Type	`string`
Default	`Per GCP > CIS v1`
Valid Values [YAML]	`Per GCP > CIS v1` `Skip` `Check: Level 1 (Not Scored)`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v071101

Policy Type URI

tmod:@turbot/gcp-cisv1#/policy/types/r0405

GraphQL

query policyType(id: "tmod:@turbot/gcp-cisv1#/policy/types/r0405") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv1#/policy/types/r0405'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv1#/policy/types/r0405'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-cisv1#/policy/types/r0405"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv1#/policy/types/r0405"