GCP Terraform Misconfiguration: Compute Engine IP Forwarding Enabled

A Terraform configuration sets up a Compute Engine instance that enables IP forwarding.

Failure to block unwanted network traffic expands a cloud service's attack surface.

By default, IP forwarding is disabled in a Compute Engine instance. IP forwarding allows sending and receiving packets with non-matching source or destination IPs. An attacker can exploit this by routing packets through the Compute Engine instance to bypass network access control.

Example 1: The following Terraform configuration enables IP forwarding by setting can_ip_forward to true.

resource "google_compute_instance" "compute_instance_demo" {
  ...
  can_ip_forward = true
  ...
}