Compute engine with a private IP only but assessable on the internet

[Sheldon_Sab]

Hi there,

I have the security command center setup for Google Cloud instance and one of the vulnerabilities that gets flagged is my compute engine (webserver) has a public IP address which is a a security risk because it allows attackers to directly access the instance from the internet.

what alternative do I have to not have a external IP addresses on my compute engine but still have my website accessible publicly?

Thank you in advance  

[kumards]

Hello @Sheldon_Sab ,

Consider using an external HTTP/S load balancer with an instance group that includes your webserver VM as the backend, as described in this guide: https://cloud.google.com/load-balancing/docs/https/setting-up-reg-ext-https-lb.

If you need SSH access to the VM (say, for admin purposes), choose from one of the methods described in this guide: https://cloud.google.com/compute/docs/connect/ssh-internal-ip. 

I hope this helps.

[VannGuce]

Hi,

Just an add on to Mr. @kumards answer, which I also agree with, you also need to configure your DNS server’s A record and point to the public IP address of your Load Balancer. Here is the example configuration of an A record configuration under Cloud DNS[1].

[1]https://cloud.google.com/dns/docs/set-up-dns-records-domain-name#create_a_managed_public_zone_in