Compute Engine instances should have custom metadata
This control ensures that Compute Instance have custom metadata. Custom metadata facilitates simple identification and enhances searchability. The powerpipe check is compute_instance_with_custom_metadata.
Custom metadata facilitates simple identification and enhances searchability.
What this control checks
Compute Instances should have custom metadata.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_instance_with_custom_metadata.
Related controls
- Compute Engine instances should have 'Block Project-wide SSH keys' enabled
- Compute Engine instances should all have OS Login enabled in the project
- Compute Engine instances should have IP forwarding disabled
- Compute Engine instances should have a single network interface
- Compute Engine instances should have service account impersonation permissions restricted
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_with_custom_metadata - Powerpipe Control:
gcp_compliance.control.compute_instance_with_custom_metadata
Last reviewed: 2026-10-09