VM instance attached disks have auto-delete disabled

Check ID: compute_instance_disk_auto_delete_disabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: resilience
Resource type: compute.googleapis.com/Instance

What this check verifies

This check verifies whether GCP Compute Engine VM instances have auto-delete disabled for their attached persistent disks. When auto-delete is enabled, persistent disks are automatically removed when the associated VM instance is deleted, which can lead to unintended data loss.

Risk

With auto-delete enabled, persistent disks are automatically deleted when the associated VM instance is terminated. This could result in:

Permanent data loss if the instance is accidentally or intentionally deleted
Recovery challenges for mission-critical workloads
Compliance violations where data retention is required

Recommendation

Disable auto-delete for all persistent disks attached to production and business-critical VM instances to prevent accidental data loss. Regularly review disk configurations to ensure data retention requirements are met.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute instances set-disk-auto-delete INSTANCE_NAME --zone=ZONE --no-auto-delete --disk=DISK_NAME

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    # Disable auto-delete for the boot disk
    auto_delete = false

    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  attached_disk {
    source      = google_compute_disk.example_disk.id
    # Disable auto-delete for attached disks
    auto_delete = false
  }

  network_interface {
    network = "default"
  }
}

References

https://cloud.google.com/compute/docs/disks/add-persistent-disk

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_disk_auto_delete_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

VM instance has deletion protection enabled VM instance disks use Customer-Supplied Encryption Keys

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires