Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have custom metadata
This control ensures that Compute Instance have custom metadata. Custom metadata facilitates simple identification and enhances searchability. The powerpipe check is compute_instance_with_custom_metadata.
What this control checks
Compute Instances should have custom metadata.
Related controls
- Compute Engine instances should have 'Block Project-wide SSH keys' enabled
- Compute Engine instances should all have OS Login enabled in the project
- Compute Engine instances should have IP forwarding disabled
- Compute Engine instances should have a single network interface
- Compute Engine instances should have service account impersonation permissions restricted
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_with_custom_metadata - Powerpipe Control:
gcp_compliance.control.compute_instance_with_custom_metadata
Last reviewed: 2026-10-09