Check ID:
Provider: GCP
Service:
Severity: LOW
Categories:
Resource type:
compute_snapshot_not_outdatedProvider: GCP
Service:
computeSeverity: LOW
Categories:
resilienceResource type:
compute.googleapis.com/SnapshotWhat this check verifies
Compute Engine disk snapshots are evaluated against a configurable age threshold (default90 days) to identify snapshots exceeding the organization’s retention policy.
Risk
Outdated snapshots containing sensitive data expand the attack surface and risk data exposure if compromised. Stale snapshots may violate compliance requirements, complicate disaster recovery efforts, and introduce configuration drift that affects system integrity.Recommendation
Implement a snapshot lifecycle policy to automatically delete snapshots older than your organization’s retention requirements. Regularly review and clean up outdated snapshots to reduce storage costs and minimize data exposure risks. Consider using scheduled snapshots with automatic deletion policies.Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://cloud.google.com/compute/docs/disks/create-snapshots
- https://cloud.google.com/compute/docs/disks/snapshot-best-practices
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = compute_snapshot_not_outdated. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks