GCP Terraform Misconfiguration: Compute Engine Serial Console Enabled

A Terraform configuration sets up a Compute Engine instance that enables interactive serial console access.

Failure to block unwanted network traffic expands a cloud service's attack surface. Services open to interaction with the public are subjected to almost continuous scanning and probing by malicious entities.

By default, the serial port of a Compute Engine instance is disabled for console access. Enabling serial console access can allow attackers to connect to the Compute Engine instance from any IP address because the serial port does not support IP-based access restrictions.

Example 1: The following Terraform configuration permits interactive serial console access by setting serial-port-enable to true in the metadata argument.

resource "google_compute_instance" "compute_instance_demo" {
  ...
  metadata = {
    serial-port-enable = true
    ...
  }
  ...
}