title: GCP compute engine network egress attack
body: <p>I have observed very high egress traffic on gcp dataproc vm which cost ~1000  USD.</p>
  
  <blockquote>
    <p>Compute Engine Network Internet Egress from Americas to Americas.</p>
  </blockquote>
  
  <p>I took follow up with google support and they suggested to improve security.
  1. Service account keys
  2. Provide password/ certificate auth for open ports on external network (http and https)</p>
  
  <p>So we created new gcp account and decided not to allow any http and https traffic to our dataproc instances. 
  So no ports were open to public and created dataproc cluster with all default settings.</p>
  
  <p>But again on these new gcp vm we oberved same egress.</p>
  
  <p>We had gs bucket on same region.</p>
  
  <p>There was not much data on vm or bucket but still there was network egress in TB's.</p>
  
  <p>And we have oberved these senario only in US region, in south asia region till now we have not oberved any egress yet.</p>
  
  <p>I think this could be attack.</p>
  
  <p>Please let me know if some one else has observed same thing.</p>
  
  <p>Please help to avoid such egress</p>
  
  <p>Firewall rules
  <a href="https://i.stack.imgur.com/Q8Kia.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Q8Kia.png" alt="enter image description here"></a></p>
  
  <p>http and https firewall rules were not applicable on Dataproc vm</p>