Back to Checks
gcp

Suspended VM instance does not have persistent disks attached

compute_instance_suspended_without_persistent_disks
Service: computeSeverity: medium
OfficialBuilt-inVerified
Resource Type:compute.googleapis.com/Instance

This check identifies VM instances in a SUSPENDED or SUSPENDING state with persistent disks still attached.

Persistent disks on suspended VMs remain accessible through the GCP API and could contain sensitive data while the instance is inactive, potentially creating security blind spots in long-forgotten infrastructure.

Prowler logoProwlerprowler-provider-gcp

Risk

Persistent disks on suspended VM instances remain accessible through the GCP API and may contain sensitive data. This creates risks of unauthorized data access if permissions are misconfigured, data exposure from forgotten unmonitored infrastructure, and security blind spots where suspended resources are overlooked during reviews.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_suspended_without_persistent_disks

Recommendation

Regularly review suspended VM instances to reduce your attack surface. Either resume instances if still needed, or delete them along with their attached disks to eliminate potential data exposure. Implement automated policies to detect and alert on long-suspended instances as part of your security monitoring.

Remediation

CLI

gcloud compute instances delete INSTANCE_NAME --zone=ZONE

Terraform

# To remediate, either delete the suspended instance or resume it
# Delete by removing the resource from your Terraform configuration
# Or resume by changing the desired_status
resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  # Set desired_status to RUNNING to resume the instance
  desired_status = "RUNNING"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = "default"
  }
}

Other

1Open the Google Cloud Console
2Navigate to Compute Engine > VM instances
3Identify suspended instances with attached disks
4If the instance is no longer needed, select it and click DELETE
5If the instance will be resumed, take no action or resume it with: gcloud compute instances resume INSTANCE_NAME --zone=ZONE

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_suspended_without_persistent_disks(Check):
    """
    Ensure that VM instances in SUSPENDED state do not have persistent disks attached.

    This check identifies VM instances that are in a SUSPENDED or SUSPENDING state
    and have persistent disks still attached. Suspended VMs with attached disks
    represent unused infrastructure that continues to incur storage costs.

    - PASS: VM instance is not in SUSPENDED/SUSPENDING state, or is suspended but has no disks attached.
    - FAIL: VM instance is in SUSPENDED/SUSPENDING state with persistent disks attached.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"VM Instance {instance.name} is not suspended."

            if instance.status in ("SUSPENDED", "SUSPENDING"):
                attached_disks = [disk.name for disk in instance.disks]

                if attached_disks:
                    report.status = "FAIL"
                    report.status_extended = f"VM Instance {instance.name} is {instance.status.lower()} with {len(attached_disks)} persistent disk(s) attached: {', '.join(attached_disks)}."
                else:
                    report.status_extended = f"VM Instance {instance.name} is {instance.status.lower()} but has no persistent disks attached."

            findings.append(report)

        return findings

References