Check ID: compute_instance_suspended_without_persistent_disks
Provider: GCP
Service: compute
Severity: MEDIUM
Resource type: compute.googleapis.com/Instance

What this check verifies

This check identifies VM instances in a SUSPENDED or SUSPENDING state with persistent disks still attached. Persistent disks on suspended VMs remain accessible through the GCP API and could contain sensitive data while the instance is inactive, potentially creating security blind spots in long-forgotten infrastructure.

Risk

Persistent disks on suspended VM instances remain accessible through the GCP API and may contain sensitive data. This creates risks of unauthorized data access if permissions are misconfigured, data exposure from forgotten unmonitored infrastructure, and security blind spots where suspended resources are overlooked during reviews.

Recommendation

Regularly review suspended VM instances to reduce your attack surface. Either resume instances if still needed, or delete them along with their attached disks to eliminate potential data exposure. Implement automated policies to detect and alert on long-suspended instances as part of your security monitoring.

Remediation

gcloud compute instances delete INSTANCE_NAME --zone=ZONE

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_suspended_without_persistent_disks. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks