How can I find unattached firewall rules - security

Question

I'm reviewing firewall rules. The rules appear to be attached by tag, is there a way to identify firewall rules to which there is no corresponding resource?

Answer 1

Objects "VM instance" and "Firewall rule" have a "Network tag" attribute, that logically binds them:
CloudShell:$ gcloud compute instances describe lamp-1-vm --zone=us-central1-f
...
tags:
items:
- lamp-1-deployment
CloudShell:$ gcloud compute firewall-rules describe my-http-enable
...
targetTags:
- lamp-1-deployment
You may use gcloud and some shell scripting to build a list of firewall rules with network tags, and a list of instances with tags, and then use a loop to seek for firewall rules whose tags are not in use.
Here you'll find some useful examples:
Filtering and formatting fun with gcloud, GCP’s command line interface

Answer 2

I had a go at building a solution to this puzzle which can be found in the public repo here:
https://github.com/kolban-google/firewall-instances
The docs for it are:
Within a GCP project we can define firewall rules. These rules can be associated with compute
engine instances through the use of tags. In a firewall rule, we can specify a set of one or more
named tags and the rule will be applied only if a tag in the firewall rule matches a tag associated
with a compute engine. As our project grows, we may end up with lots of firewall rules and we may
find ourselves asking the question "Are there any firewall rules which have no matching
compute engine instances?". We can manually examine each firewall rule and then look to see if
there are any matching instances but this is laborious and error prone. In this project we describe
a sample tool that dynamically retrieves the current firewall rules and then automatically searches
for matching compute engine instances that have the corresponding tag.
To run the tool download and then:
npm install
node index.js --projectNum [projectNum]
where projectNum is the numeric id of a project. The result is a JSON string of the format:
[
{
"name": "[FIREWALL_RULE_NAME]",
"instances": [
"INSTANCE_NAME",
...
]
},
...
]
If a firewall rule has no matching instances, the instances field will not be populated.
From an algorithm perspective:
Get the list of all firewall rules;
For each of the firewall rules {
Get the networkTags for that rule;
Search for all compute instances that have one or more of those tags;
List the rule and the associated compute instances that have the tags;
}
This project is provided as-is as an example.