What problem does it solve?
GCP environments often accumulate overly permissive firewall rules, such as SSH open to 0.0.0.0/0 or unrestricted egress, which expose workloads to attack and data exfiltration. This Skill provides a structured workflow to audit existing rules, implement least-privilege ingress and egress controls, deploy hierarchical firewall policies, and validate enforcement with VPC Flow Logs.
Core Features & Use Cases
- Firewall Rule Auditing: Enumerate rules and detect risky configurations like internet-open SSH/RDP, allow-all protocols, disabled rules, and shadowed deny rules.
- Least-Privilege Rule Creation: Build targeted ingress rules using network tags and service accounts, plus default-deny egress with explicit allow rules for DNS, Google APIs, and partner CIDRs.
- Hierarchical Policies & Monitoring: Deploy organization-level firewall policies and enable VPC Flow Logs with Cloud Logging queries to verify which rules actually match traffic.
- Use Case: After Security Command Center flags 14 firewall findings in a production VPC, use this Skill to baseline traffic with flow logs, replace default-allow rules with tier-specific rules, and add a default-deny egress policy without causing outages.
Quick Start
Audit my GCP project's firewall rules for overly permissive ingress and help me replace them with least-privilege rules and a default-deny egress policy.
