Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Resource type:
compute_instance_suspended_without_persistent_disksProvider: GCP
Service:
computeSeverity: MEDIUM
Resource type:
compute.googleapis.com/InstanceWhat this check verifies
This check identifies VM instances in a SUSPENDED or SUSPENDING state with persistent disks still attached. Persistent disks on suspended VMs remain accessible through the GCP API and could contain sensitive data while the instance is inactive, potentially creating security blind spots in long-forgotten infrastructure.Risk
Persistent disks on suspended VM instances remain accessible through the GCP API and may contain sensitive data. This creates risks of unauthorized data access if permissions are misconfigured, data exposure from forgotten unmonitored infrastructure, and security blind spots where suspended resources are overlooked during reviews.Recommendation
Regularly review suspended VM instances to reduce your attack surface. Either resume instances if still needed, or delete them along with their attached disks to eliminate potential data exposure. Implement automated policies to detect and alert on long-suspended instances as part of your security monitoring.Remediation
- CLI
- Terraform
- Dashboard steps
References
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = compute_instance_suspended_without_persistent_disks. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks