Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have permissions to disrupt logging restricted
This control checks whether a Compute Engine instance is configured so that it does not disrupt logging permissions. It evaluates the instance's access settings and reports instances that are able to interfere with logging, and instances that are not.
What this control checks
Compute Instances should restrict disrupt logging permission
Related controls
- Compute Engine instances should have data destruction permissions restricted
- Compute Engine instances should not use the default service account
- Compute Engine instances should have Confidential Computing enabled
- Compute Engine instances should have deletion protection enabled
- Cloud Storage buckets used for exporting logs should prohibit anonymous and public access
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_no_disrupt_logging_permission - Powerpipe Control:
gcp_compliance.control.compute_instance_no_disrupt_logging_permission
Last reviewed: 2026-10-09