Check ID: compute_instance_deletion_protection_enabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: resilience
Resource type: compute.googleapis.com/Instance

What this check verifies

This check verifies whether GCP Compute Engine VM instances have deletion protection enabled to prevent accidental termination of production or critical workloads.

Risk

Without deletion protection enabled, VM instances are vulnerable to accidental deletion by users with sufficient permissions. This could result in:
  • Service disruption and downtime for critical applications
  • Data loss if persistent disks are also deleted
  • Recovery delays while recreating instances and restoring configurations

Recommendation

Enable deletion protection on all production and business-critical VM instances to prevent accidental termination. Regularly review instances to ensure critical workloads are protected.

Remediation

gcloud compute instances update INSTANCE_NAME --deletion-protection --zone=ZONE

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_deletion_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks