Compute Engine instances should have IAM write permissions restricted
This control ensures that Compute Instance does not allow IAM write permissions. The powerpipe check is titled "Compute Instances should restrict IAM write permission".
What this control checks
Compute Instances should restrict IAM write permission
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_instance_no_iam_write_permission.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_no_iam_write_permission - Powerpipe Control:
gcp_compliance.control.compute_instance_no_iam_write_permission
Last reviewed: 2026-10-09