Compute Engine disk image is not publicly shared

Check ID: compute_image_not_publicly_shared
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: internet-exposed
Resource type: compute.googleapis.com/Image

What this check verifies

Custom disk images should not be shared publicly with allAuthenticatedUsers. Per Google Cloud API restrictions, allUsers cannot be assigned to Compute Engine images. The concern is allAuthenticatedUsers, which grants access to anyone with a Google account, potentially exposing application snapshots and sensitive data.

Risk

Publicly shared disk images can expose sensitive data and application configurations to unauthorized users.

Any authenticated GCP user can access the image content

Could lead to data breaches if images contain secrets or proprietary code

Attackers may use exposed images to understand application architecture

Remediation

CLI
Terraform
Dashboard steps

gcloud compute images remove-iam-policy-binding IMAGE_NAME --member='allAuthenticatedUsers' --role='ROLE_NAME'

resource "google_compute_image_iam_binding" "example_resource" {
  project = "your-project-id"
  image   = "your-image-name"
  role    = "roles/compute.imageUser"
  # Remove allAuthenticatedUsers and grant access only to specific members
  members = [
    "user:[email protected]",
  ]
}

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_image_not_publicly_shared. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

Compute Engine disk image is not publicly shared

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires