> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Default VPC Should Not Be Used

### More Info:

Determines whether the default VPC is being used for launching new services or artifacts. The default VPC should not be used in order to avoid launching multiple services in the same network which may not require connectivity. Each application, or network tier, should use its own VPC.

### Risk Level

High

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CIS GCP
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Default VPC should not be used" for GCP using the GCP console, follow these steps:

        1. Login to the GCP console at [https://console.cloud.google.com/](https://console.cloud.google.com/)
        2. Select the project that is using the default VPC.
        3. In the left navigation pane, select "VPC network" and then select "VPC network".
        4. Click on the name of the default VPC.
        5. Click on "Edit" at the top of the screen.
        6. In the "Edit VPC network" screen, uncheck the "Default" checkbox.
        7. Click "Save" to apply the changes.

        This will remove the default VPC from the project, which is a best practice for security and network segmentation. You can then create custom VPCs with specific configurations to meet your project's needs.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Default VPC Should Not Be Used" misconfiguration in GCP using GCP CLI, you can follow these steps:

        1. Identify all the GCP projects that are using the default VPC. You can use the following command to list all the projects:

        ```
        gcloud projects list
        ```

        2. For each project that is using the default VPC, create a new VPC network. You can use the following command to create a new VPC network:

        ```
        gcloud compute networks create [NETWORK_NAME] --subnet-mode=auto --bgp-routing-mode=regional
        ```

        3. Once the new VPC network is created, you can move all the existing resources from the default VPC to the new VPC network. You can use the following command to move a resource to a new VPC network:

        ```
        gcloud compute instances move [INSTANCE_NAME] --zone [ZONE] --network [NETWORK_NAME]
        ```

        4. Once all the resources are moved to the new VPC network, you can delete the default VPC network. You can use the following command to delete the default VPC network:

        ```
        gcloud compute networks delete default
        ```

        5. Finally, you should update your organization's policies to prevent the use of default VPCs in the future.

        Note: Before making any changes to your GCP environment, it is recommended to test the changes in a non-production environment to ensure that there are no unintended consequences.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Default VPC Should Not Be Used" misconfiguration in GCP using Python, you can follow the below steps:

        1. Install the necessary Python packages:

        ```python theme={null}
        pip install google-cloud-compute
        ```

        2. Authenticate to GCP:

        ```python theme={null}
        from google.oauth2 import service_account
        from google.cloud import compute_v1

        credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_key_file>')
        compute_client = compute_v1.ComputeClient(credentials=credentials)
        ```

        3. Get the list of all VPCs:

        ```python theme={null}
        vpcs = compute_client.networks().list(project='<project_id>').execute()
        ```

        4. Check if any of the VPCs are default:

        ```python theme={null}
        for vpc in vpcs['items']:
            if vpc['autoCreateSubnetworks'] == True:
                print(f"{vpc['name']} is a default VPC and should be deleted.")
        ```

        5. Delete the default VPC:

        ```python theme={null}
        compute_client.networks().delete(project='<project_id>', network='<default_vpc_name>').execute()
        ```

        Note: Replace `<path_to_service_account_key_file>`, `<project_id>`, and `<default_vpc_name>` with the appropriate values for your GCP environment. Also, make sure to test the script in a non-production environment before running it in production.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # New application-specific VPC network (replace placeholders)
        resource "google_compute_network" "APP_VPC" {
          name                    = "APP_VPC_NAME"          # e.g. "orders-app-vpc"
          project                 = "GCP_PROJECT_ID"        # your GCP project ID
          auto_create_subnetworks = false                   # use custom subnets only
        }

        resource "google_compute_subnetwork" "APP_SUBNET" {
          name          = "APP_SUBNET_NAME"                # e.g. "orders-app-subnet-a"
          project       = "GCP_PROJECT_ID"
          region        = "GCP_REGION"                     # e.g. "us-central1"
          network       = google_compute_network.APP_VPC.id
          ip_cidr_range = "APP_SUBNET_CIDR"                # e.g. "10.10.0.0/24"
        }

        # Example: move a VM instance off the default network onto the new VPC
        # WARNING: changing the `network_interface` forces replacement of the instance
        # and will cause downtime for this VM.
        resource "google_compute_instance" "APP_VM" {
          name         = "APP_VM_NAME"
          project      = "GCP_PROJECT_ID"
          zone         = "GCP_ZONE"
          machine_type = "e2-medium"

          boot_disk {
            initialize_params {
              image = "BOOT_IMAGE"
            }
          }

          # Previously this might have used:
          # network_interface {
          #   network = "default"
          # }
          #
          # Now explicitly use the new VPC/subnet instead of the default VPC.
          network_interface {
            subnetwork = google_compute_subnetwork.APP_SUBNET.id
            # optional: access_config {} for external IP
          }

          # ... other arguments ...
        }
        ```

        Terraform cannot delete the default VPC in-place; to remove it entirely you must delete it via the GCP Console or `gcloud compute networks delete default` after all resources have been moved off it.

        `terraform plan` should show:

        * `+` creation of `google_compute_network.APP_VPC` and `google_compute_subnetwork.APP_SUBNET`.
        * `~` update (typically `-/+` replacement) of each resource moved off the default VPC, with `network_interface.network`/`subnetwork` changing from `"default"` (or the default subnet) to the new VPC/subnet.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/vpc/docs/vpc](https://cloud.google.com/vpc/docs/vpc)