VPC Firewall Rule
Does ZopNight manage VPC Firewall Rule?
VPC firewall rules are free, since no meter runs on a rule, yet each 0.0.0.0/0 allow widens the attack surface of every VM it matches. ZopNight discovers all rules through Cloud Asset Inventory to complete network topology and drive security-oriented hygiene checks alongside cost findings.
Rules that fire on VPC Firewall Rule
VPC firewall rules control which traffic can reach or leave VM instances. They are free, but overly permissive rules are a security and audit concern that ZopNight surfaces alongside cost findings.
Rules cost nothing; exposure costs plenty
Google bills nothing for a firewall rule: not per rule, not per evaluation, not per packet matched. What a rule spends is trust. An allow rule scoped to 0.0.0.0/0 on port 22 turns every VM carrying its target tag into an internet-reachable SSH endpoint, and the eventual price of that shows up as incident response rather than a line on the invoice. Firewall rules are the clearest case in the directory of a resource whose cost is entirely risk-shaped.
Completing the topology picture with firewall state
ZopDev pulls every firewall rule in through Cloud Asset Inventory, for two reasons. First, topology: knowing which rules apply to which instances is part of understanding how a network actually fits together, the same map that subnets and peerings feed. Second, hygiene: security-oriented recommendation checks read rule state, so permissive or forgotten rules surface next to cost findings instead of living in a separate tool nobody opens. Nothing about a rule can be scheduled; there is no meter to pause. Coverage is discovery and reporting only.
The rules worth deleting this quarter
Rule sets age badly in three specific ways. Orphaned target tags: a rule whose tag no longer matches any instance does nothing today, but silently activates the day someone reuses the tag. Debug-era allows: broad ranges opened during an incident and never narrowed once the incident closed. And duplicate shadowed rules: lower-priority rules fully covered by higher-priority ones, which add audit noise and make the real posture harder to read than it should be.
Where firewall policies live in the console
Google Cloud console → VPC network → Firewall lists every rule with its direction, priority, targets, source ranges, and hit-logging state, filterable per network. It is the fastest place to spot an allow that should have died with its sprint.