Check ID: compute_instance_preemptible_vm_disabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: resilience
Resource type: compute.googleapis.com/Instance

​
What this check verifies

This check verifies that VM instances are not configured as preemptible or Spot VMs. Both preemptible and Spot VMs can be terminated by Google at any time when resources are needed elsewhere, making them unsuitable for production and business-critical workloads. Spot VMs are the newer version of preemptible VMs and are Google’s recommended approach for interruptible workloads.

​
Risk

Preemptible and Spot VMs may be terminated at any time by Google Cloud, causing:
  • Service disruptions for production workloads
  • Data loss if workloads are not fault-tolerant
  • Availability issues for business-critical applications
They are designed for batch jobs and fault-tolerant workloads only.

​
Recommendation

Use standard provisioning model for production and business-critical VM instances. Preemptible and Spot VMs should only be used for fault-tolerant, batch processing, or non-critical workloads that can handle interruptions.

​
Remediation

resource "google_compute_instance" "example_resource" {
  name         = "example-instance"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  scheduling {
    # Use standard provisioning model for production workloads (not Spot)
    provisioning_model = "STANDARD"
    # Also ensure preemptible is false (legacy field)
    preemptible = false
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_preemptible_vm_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks