GCP Firewall rule allows all traffic on FTP port (21) misconfiguration detected in code

GCP Firewall rule allows all traffic on FTP port (21) misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_75
Category - Subcategory	Public Exposure - Sensitive Ports
Provider	GCP
Severity	LOW
Framework	Terraform
Mapped CSPM/KSPM Rule	fab6a8ee-dc82-49f0-8c2c-a2a5c7666539

Impact

This policy identifies GCP Firewall rules which allow all inbound traffic on FTP port (21). Allowing access from arbitrary IP addresses to this port increases the attack surface of your network. It is recommended that the FTP port (21) should be allowed to specific IP addresses.

How to Fix

[source,go]

pass

resource "google_compute_firewall" "restricted" { name = "example" network = "google_compute_network.vpc.name"

allow { protocol = "tcp" ports = ["21"] }

source_ranges = ["172.1.2.3/32"] target_tags = ["ftp"] }