To reduce your attack surface, Vm instances should not have public IP addresses. Instead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.
Recommended Mitigation
Make sure external IP isn't configured for the Vm instance.