Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have data destruction permissions restricted
This control checks that a Compute Instance does not allow data destruction permissions. It evaluates each Compute Engine instance and flags any instance whose configuration grants permissions that would let data be destroyed or deleted.
What this control checks
Compute Instances should restrict data destruction permission
Related controls
- Compute Engine instances should not use the default service account with full access to all Cloud APIs
- Compute Engine instances should not use the default service account
- Compute Engine instances should have custom metadata
- Compute Engine instances should have IP forwarding disabled
- Disks for critical VMs should use Customer-Supplied Encryption Keys (CSEK) for encryption
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_no_data_destruction_permission - Powerpipe Control:
gcp_compliance.control.compute_instance_no_data_destruction_permission
Last reviewed: 2026-10-09