Back to Checks
gcp

VM instance attached disks have auto-delete disabled

compute_instance_disk_auto_delete_disabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/Instance

This check verifies whether GCP Compute Engine VM instances have auto-delete disabled for their attached persistent disks.

When auto-delete is enabled, persistent disks are automatically removed when the associated VM instance is deleted, which can lead to unintended data loss.

Prowler logoProwlerprowler-provider-gcp

Risk

With auto-delete enabled, persistent disks are automatically deleted when the associated VM instance is terminated.

This could result in:

  • Permanent data loss if the instance is accidentally or intentionally deleted
  • Recovery challenges for mission-critical workloads
  • Compliance violations where data retention is required

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_disk_auto_delete_disabled

Recommendation

Disable auto-delete for all persistent disks attached to production and business-critical VM instances to prevent accidental data loss. Regularly review disk configurations to ensure data retention requirements are met.

Remediation

CLI

gcloud compute instances set-disk-auto-delete INSTANCE_NAME --zone=ZONE --no-auto-delete --disk=DISK_NAME

Terraform

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    # Disable auto-delete for the boot disk
    auto_delete = false

    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  attached_disk {
    source      = google_compute_disk.example_disk.id
    # Disable auto-delete for attached disks
    auto_delete = false
  }

  network_interface {
    network = "default"
  }
}

Other

1Open the Google Cloud Console
2Navigate to Compute Engine > VM instances
3Click the target VM instance name
4Click Edit
5In the Boot disk section, select 'Keep disk' from the 'When deleting instance' dropdown
6For Additional disks, click each disk and select 'Keep disk' under 'Deletion rule'
7Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_disk_auto_delete_disabled(Check):
    """
    Ensure that VM instance attached disks have auto-delete disabled.

    This check verifies whether GCP Compute Engine VM instances have auto-delete
    disabled for their attached persistent disks to prevent accidental data loss
    when the instance is terminated.

    - PASS: All attached disks have auto-delete disabled.
    - FAIL: One or more attached disks have auto-delete enabled.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"VM Instance {instance.name} has auto-delete disabled for all attached disks."

            auto_delete_disks = [
                disk.name for disk in instance.disks if disk.auto_delete
            ]

            if auto_delete_disks:
                report.status = "FAIL"
                report.status_extended = f"VM Instance {instance.name} has auto-delete enabled for the following disks: {', '.join(auto_delete_disks)}."

            findings.append(report)

        return findings

References