Description:
Compute instances should not be configured to have external IP addresses.
Rationale:
To reduce your attack surface, Compute instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.
Removing the external IP address from your Compute instance may cause some applications to stop working.
From Google Cloud Console
Go to the 'VM instances' page by visiting: https://console.cloud.google.com/compute/instances.
Click on the instance name to go the the 'Instance detail page'.
Click 'Edit'.
For each Network interface, ensure that 'External IP' is set to 'None'.
Click 'Done' and then click 'Save'.
From Google Cloud CLI
gcloud compute instances describe --zone=
networkInterfaces:
gcloud compute instances delete-access-config --zone= --access-config-name
In the above example, the 'ACCESS_CONFIG_NAME' is 'External NAT'. The name of your access config might be different.
Prevention:
You can configure the 'Define allowed external IPs for VM instances' Organization Policy to prevent VMs from being configured with public IP addresses. Learn more at: https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess