[VMC] "Overly Permissive Compute Gateway Firewall Rule detected" notification

Products

• VMware Cloud on AWS

Issue/Introduction

• A notification email titled "Overly Permissive Compute Gateway Firewall Rule Detected" was received. 
• A notification banner including "Overly Permissive Compute Gateway Firewall Rule Detected" is seen in the VMC on AWS Console. 

Environment

VMware Cloud on AWS 

Cause

• The VMC on AWS team continuously scans SDDCs. 
• When an overly-permissive inbound Compute Gateway firewall rule is seen, notifications will be sent to the Organization by email, notification banner, or both. 
• These types of rules can compromise the workload virtual machines and applications in the SDDC. 
• An overly-permissive inbound Compute Gatway rule is: 
  • Source=Any, Destination=Any, Services=Any, Applied To: All uplinks/Internet, Action=Allow

Resolution

• To resolve this issue and to stop receiving these types of notifications, modify the Compute Gateway firewall rule "Source" section. 
• It is recommended that access only be allowed from trusted source addresses. 

Additional Information

• Configure Compute Gateway Networking and Security
• VMware Cloud on AWS: Shared Responsibility Model Overview