Back to Checks
gcp

VM instance is not configured as preemptible or Spot VM

compute_instance_preemptible_vm_disabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/Instance

This check verifies that VM instances are not configured as preemptible or Spot VMs.

Both preemptible and Spot VMs can be terminated by Google at any time when resources are needed elsewhere, making them unsuitable for production and business-critical workloads. Spot VMs are the newer version of preemptible VMs and are Google's recommended approach for interruptible workloads.

Prowler logoProwlerprowler-provider-gcp

Risk

Preemptible and Spot VMs may be terminated at any time by Google Cloud, causing:

  • Service disruptions for production workloads
  • Data loss if workloads are not fault-tolerant
  • Availability issues for business-critical applications

They are designed for batch jobs and fault-tolerant workloads only.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_preemptible_vm_disabled

Recommendation

Use standard provisioning model for production and business-critical VM instances. Preemptible and Spot VMs should only be used for fault-tolerant, batch processing, or non-critical workloads that can handle interruptions.

Remediation

Terraform

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  scheduling {
    # Use standard provisioning model for production workloads (not Spot)
    provisioning_model = "STANDARD"
    # Also ensure preemptible is false (legacy field)
    preemptible = false
  }
}

Other

1Go to Compute Engine console
2Select the preemptible or Spot VM instance
3Create a machine image from the instance
4Create a new instance from the machine image
5During creation, set **VM provisioning model** to **Standard** (not Spot)
6Delete the original preemptible or Spot VM instance

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_preemptible_vm_disabled(Check):
    """
    Ensure GCP Compute Engine VM instances are not preemptible or Spot VMs.

    - PASS: VM instance is not preemptible (preemptible=False) and not Spot
      (provisioningModel != "SPOT").
    - FAIL: VM instance is preemptible (preemptible=True) or Spot
      (provisioningModel="SPOT").
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = (
                f"VM Instance {instance.name} is not preemptible or Spot VM."
            )

            if instance.preemptible or instance.provisioning_model == "SPOT":
                report.status = "FAIL"
                vm_type = "preemptible" if instance.preemptible else "Spot VM"
                report.status_extended = (
                    f"VM Instance {instance.name} is configured as {vm_type}."
                )

            findings.append(report)
        return findings

References