Back to Checks
gcp

Compute Engine disk snapshot is not outdated

compute_snapshot_not_outdated
Service: computeSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:compute.googleapis.com/Snapshot

Compute Engine disk snapshots are evaluated against a configurable age threshold (default 90 days) to identify snapshots exceeding the organization's retention policy.

Prowler logoProwlerprowler-provider-gcp

Risk

Outdated snapshots containing sensitive data expand the attack surface and risk data exposure if compromised.

Stale snapshots may violate compliance requirements, complicate disaster recovery efforts, and introduce configuration drift that affects system integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_snapshot_not_outdated

Recommendation

Implement a snapshot lifecycle policy to automatically delete snapshots older than your organization's retention requirements. Regularly review and clean up outdated snapshots to reduce storage costs and minimize data exposure risks. Consider using scheduled snapshots with automatic deletion policies.

Remediation

CLI

gcloud compute snapshots delete SNAPSHOT_NAME --project=PROJECT_ID

Terraform

resource "google_compute_resource_policy" "snapshot_schedule" {
  name   = "snapshot-schedule-with-retention"
  region = var.region

  snapshot_schedule_policy {
    schedule {
      daily_schedule {
        days_in_cycle = 1
        start_time    = "04:00"
      }
    }

    # Automatically delete snapshots older than 90 days
    retention_policy {
      max_retention_days    = 90
      on_source_disk_delete = "KEEP_AUTO_SNAPSHOTS"
    }
  }
}

resource "google_compute_disk_resource_policy_attachment" "attachment" {
  name = google_compute_resource_policy.snapshot_schedule.name
  disk = google_compute_disk.example.name
  zone = var.zone
}

Other

1Open Google Cloud Console and navigate to Compute Engine > Snapshots
2Identify snapshots older than your retention policy
3Select outdated snapshots and click **Delete**
4Confirm the deletion
5To automate cleanup, create a snapshot schedule with auto-delete policies under Compute Engine > Snapshots > Snapshot schedules.

Check Code

from datetime import datetime, timezone

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_snapshot_not_outdated(Check):
    """Check that Compute Engine disk snapshots are not outdated.

    This check ensures Compute Engine disk snapshots are within the configured
    age threshold (default 90 days) to help control storage costs and limit
    exposure from stale data.

    - PASS: Snapshot is not outdated (within the acceptable age threshold).
    - FAIL: Snapshot is outdated (exceeds the configured age threshold).
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []

        max_snapshot_age_days = compute_client.audit_config.get(
            "max_snapshot_age_days", 90
        )

        current_time = datetime.now(timezone.utc)

        for snapshot in compute_client.snapshots:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=snapshot,
                location="global",
            )

            if snapshot.creation_timestamp is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Disk snapshot {snapshot.name} timestamp could not be retrieved "
                    "and cannot be evaluated for age."
                )
                findings.append(report)
                continue

            snapshot_age = (current_time - snapshot.creation_timestamp).days

            if snapshot_age > max_snapshot_age_days:
                report.status = "FAIL"
                report.status_extended = (
                    f"Disk snapshot {snapshot.name} is {snapshot_age} days old, "
                    f"exceeding the {max_snapshot_age_days} day threshold."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Disk snapshot {snapshot.name} is {snapshot_age} days old, "
                    f"within the {max_snapshot_age_days} day threshold."
                )

            findings.append(report)

        return findings

References