Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have database write permissions restricted
This control ensures that Compute Instance does not allow database write permissions. The powerpipe check is titled "Compute Instances should restrict database write permission".
What this control checks
Compute Instances should restrict database write permission
Related controls
- Compute Engine instances should have permissions to disrupt logging restricted
- Compute Engine instances should have Deployment Manager permissions restricted
- Cloud SQL instances should have IP assignment set to private
- Projects should have OS Login enabled at project level
- API keys should have rotation configured every 90 days
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_no_database_write_permission - Powerpipe Control:
gcp_compliance.control.compute_instance_no_database_write_permission
Last reviewed: 2026-10-09