Back to Checks
gcp

Compute Engine disk image is not publicly shared

compute_image_not_publicly_shared
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:compute.googleapis.com/Image

Custom disk images should not be shared publicly with allAuthenticatedUsers. Per Google Cloud API restrictions, allUsers cannot be assigned to Compute Engine images. The concern is allAuthenticatedUsers, which grants access to anyone with a Google account, potentially exposing application snapshots and sensitive data.

Prowler logoProwlerprowler-provider-gcp

Risk

Publicly shared disk images can expose sensitive data and application configurations to unauthorized users.

  • Any authenticated GCP user can access the image content
  • Could lead to data breaches if images contain secrets or proprietary code
  • Attackers may use exposed images to understand application architecture

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_image_not_publicly_shared

Recommendation

Restrict access to custom disk images by removing the allAuthenticatedUsers IAM binding. Apply the principle of least privilege by granting access only to specific users, groups, or service accounts that require it.

Remediation

CLI

gcloud compute images remove-iam-policy-binding IMAGE_NAME --member='allAuthenticatedUsers' --role='ROLE_NAME'

Terraform

resource "google_compute_image_iam_binding" "example_resource" {
  project = "your-project-id"
  image   = "your-image-name"
  role    = "roles/compute.imageUser"
  # Remove allAuthenticatedUsers and grant access only to specific members
  members = [
    "user:specific-user@example.com",
  ]
}

Other

1Go to the GCP Console
2Navigate to Compute Engine > Images
3Select the disk image
4Click on the INFO PANEL to view permissions
5Remove **allAuthenticatedUsers** bindings
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_image_not_publicly_shared(Check):
    """Ensure Compute Engine disk images are not publicly shared.

    This check evaluates whether custom disk images in GCP Compute Engine
    have IAM bindings that grant access to allAuthenticatedUsers, which allows
    anyone with a Google account to access the image.

    Note: allUsers cannot be assigned to Compute Engine images (API restriction).
    Only allAuthenticatedUsers can be set, which is the security risk.
    Reference: https://cloud.google.com/compute/docs/images/managing-access-custom-images

    - PASS: The disk image is not publicly shared.
    - FAIL: The disk image is publicly shared with allAuthenticatedUsers.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for image in compute_client.images:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=image,
                location="global",
            )
            report.status = "PASS"
            report.status_extended = (
                f"Compute Engine disk image {image.name} is not publicly shared."
            )

            if image.publicly_shared:
                report.status = "FAIL"
                report.status_extended = f"Compute Engine disk image {image.name} is publicly shared with allAuthenticatedUsers."

            findings.append(report)

        return findings

References