Prisma Cloud: False positive Alert for policy "GCP VM instance with network path from the internet (0.0.0.0/0)"

Critical and high alerts occur due to a prism failure in detecting VMs exposed to the internet High:

GCP VM instance that is internet reachable with unrestricted access (0.0.0.0/0).

This is due to a source NAT by Google about the health check rules in the VPC firewall here . Users have VM instances exposed to the internet with a loadbalancer and those instances are protected by cloud armor.

• Prisma Cloud CSPM
• GCP

Cloud Armor is not supported as policy rules as of today. 

Fixed in version PCS 24.3.1 customer is able to exclude assets based on tags.

* Clone policy GCP VM instance with network path from the internet (0.0.0.0/0) and exclude asset based on the dest.tag using NOT IN ()
 

config from network where source.network = '0.0.0.0/0' and address.match.criteria = 'full_match' and dest.resource.type = 'Instance' and dest.cloud.type = 'GCP' and dest.resource.state = 'Active' and dest.tag NOT IN (key1=value1, key2=value2, etc) 

Reference:

• https://docs.prismacloud.io/en/enterprise-edition/rn/prisma-cloud-release-info/features-introduced-in-2024/features-introduced-in-august-2024
  • GCP VM instance that is internet reachable with unrestricted access (0.0.0.0/0)
    • Updated Policy Name — GCP VM instance with network path from the internet (0.0.0.0/0)