Compute Engine VM instances have Automatic Restart enabled

Check ID: compute_instance_automatic_restart_enabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: resilience
Resource type: compute.googleapis.com/Instance

What this check verifies

Google Compute Engine virtual machine instances are evaluated to ensure that Automatic Restart is enabled. This feature allows the Google Cloud Compute Engine service to automatically restart VM instances when they are terminated due to non-user-initiated reasons such as maintenance events, hardware failures, or software failures.

Risk

VM instances without Automatic Restart enabled will not recover automatically from host maintenance events or unexpected failures, potentially leading to prolonged service downtime and requiring manual intervention to restore services.

Recommendation

Enable the Automatic Restart feature for Compute Engine VM instances to enhance system reliability by automatically recovering from crashes or system-initiated terminations. This setting does not interfere with user-initiated shutdowns or stops.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances update <INSTANCE_NAME> --restart-on-failure --zone=<ZONE>

# Example: enable Automatic Restart for a Compute Engine VM instance
resource "google_compute_instance" "example" {
  name         = var.instance_name
  machine_type = var.machine_type
  zone         = var.zone

  scheduling {
    automatic_restart   = true
    on_host_maintenance = "MIGRATE"
  }
}

References

https://cloud.google.com/compute/docs/instances/setting-instance-scheduling-options

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_automatic_restart_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Compute Engine disk image is not publicly shared VM instance has Block project-wide SSH keys enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires