Compute Engine VMs with the interactive serial console switched on
What does ZopNight detect here?
Compute Engine VMs are flagged when the instance's own metadata sets `serial-port-enable` to `TRUE`. Google warns that the interactive serial console accepts connections from any IP address and does not honour IP allowlists unless VPC Service Controls is in place, so firewall rules that lock down SSH do nothing for this path.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-1204 |
| Category | compliance |
| Severity | high |
| Metric | none — pure configuration read |
| Threshold | instance metadata serial-port-enable is TRUE |
| Source | ZopNight |
| Permissions used | compute.instances.list · compute.instances.get |
Where it applies
Why the serial console sidesteps your firewall
The interactive serial console exists for rescue work on a VM that will not boot far enough to
accept SSH. It is reached through a Google endpoint, ssh-serialport.googleapis.com on TCP port
9600, not through the VM’s network interface. Google’s
serial console guide
puts the consequence plainly: the console does not support IP-based restrictions such as
allowlists unless you use VPC Service Controls, and clients can attempt to connect from any IP
address. Anyone with the right SSH key, username, project ID, zone and instance name gets a
console session.
So a VM with no external IP and a tight firewall can still be reachable. That is why the rule carries high severity even though nothing about it costs money.
Checking the metadata yourself
The per-instance item is what this rule reads. Look for serial-port-enable in the output:
gcloud compute instances describe VM_NAME --zone=ZONE \ --format="value(metadata.items)"Project metadata can switch the console on for every VM too, and a per-instance value overrides the project value either way:
gcloud compute project-info describe \ --format="value(commonInstanceMetadata.items)"When a finding is raised
ZopNight records the instance-level serial-port-enable value during inventory and fires only
when it is exactly true. There is no time window: a console left on for one day is flagged the
same as one left on for a year.
Cases this check does not flag
A VM with the item set to false, or with no item at all, is silent. Because only the instance value is read, a VM that gets the console solely from project-wide metadata is not flagged here, so review the project setting separately with the command above.
High severity, zero saving
No cost is attached. The risk is an interactive login path that bypasses network controls and is easy to forget once the debugging session that needed it is over.
Closing the console
- Turn it off on the instance:
gcloud compute instances add-metadata VM_NAME --zone=ZONE --metadata serial-port-enable=FALSE. - Check project metadata and set the same key to
FALSEthere if it is on. - Enforce it with the
compute.disableSerialPortAccessorganization policy constraint so nobody can re-enable it casually. - For routine shell access to private VMs, use IAP TCP forwarding instead.