Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
compute_instance_deletion_protection_enabledProvider: GCP
Service:
computeSeverity: MEDIUM
Categories:
resilienceResource type:
compute.googleapis.com/InstanceWhat this check verifies
This check verifies whether GCP Compute Engine VM instances have deletion protection enabled to prevent accidental termination of production or critical workloads.Risk
Without deletion protection enabled, VM instances are vulnerable to accidental deletion by users with sufficient permissions. This could result in:- Service disruption and downtime for critical applications
- Data loss if persistent disks are also deleted
- Recovery delays while recreating instances and restoring configurations
Recommendation
Enable deletion protection on all production and business-critical VM instances to prevent accidental termination. Regularly review instances to ensure critical workloads are protected.Remediation
- CLI
- Terraform
- Dashboard steps
References
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = compute_instance_deletion_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks