Workbench notebooks reachable from the public internet
What does ZopNight detect here?
Workbench notebooks created without disabling public IP receive an ephemeral external address by default, exposing a research VM to the internet. ZopNight fires only when the discoverer positively stamped publicIp=true, resolved from the gceSetup.disablePublicIp boolean plus an accessConfigs scan, and recommends IAP TCP forwarding instead, a $0 security fix.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1237 |
| Category | security |
| Severity | medium |
| Metric | none — pure configuration read |
| Source | vertex_security.go |
Where it applies
Public by default is the trap
A Workbench instance created without an explicit network choice gets a default ephemeral external IP, which is GCE’s behavior inherited by the notebook VM underneath. Data-science notebooks are a bad thing to expose: they hold service-account credentials, mounted datasets, and a Jupyter server, and they are typically created quickly outside the hardened-infrastructure review path that catches this on production VMs.
How the flag is resolved
The discoverer resolves exposure from the authoritative source: the
gceSetup.disablePublicIp boolean on Workbench v2 instances (top-level noPublicIp on
legacy ones), defaulting to public when unset (an instance with no explicit
access configuration still receives an ephemeral address), OR-ed with a direct scan of
accessConfigs for an external IP. The result lands as a single publicIp stamp, and
the rule fires only on a positively recorded true; a notebook whose exposure was never
resolved is skipped rather than guessed at. This is a $0, severity-medium security
finding: there is no dollar lever, and the categories that carry savings floors do not
apply.
IAP replaces the address
Connectivity without exposure is a solved problem: IAP TCP forwarding tunnels the Jupyter session through Google’s identity-aware proxy, and Private Google Access covers the notebook’s outbound calls to Google APIs. Neither needs the external address, and both leave access controlled by IAM rather than by whoever finds the IP.
Audit exposure across notebooks
gcloud workbench instances list --location us-central1-a \ --format="table(name,gceSetup.disablePublicIp,state)"Every row showing false (or empty) in the middle column is carrying an external address.
Recreate, not patch
Workbench does not support flipping an existing instance to private-only in place. The remediation is to recreate the instance with public IP disabled and move the work over. Since notebook state lives on the data disk and in Git, the recreate is cheap; schedule it alongside the Secure Boot fix (RC-1236) so the fleet is touched once, not twice.