Compute Engine disk images should not be publicly shared
Custom disk images should not be shared publicly with `allAuthenticatedUsers`. Per Google Cloud API restrictions, `allUsers` cannot be assigned to Compute Engine images. `allAuthenticatedUsers` grants access to anyone with a Google account.
Publicly shared disk images can expose sensitive data and application configurations to unauthorized users. Any authenticated GCP user can access the image content. Could lead to data breaches if images contain secrets or proprietary code.
What this control checks
Compute Engine disk images are not shared publicly
Common pitfalls
allUsers cannot be assigned to images
Per Google Cloud API restrictions, allUsers cannot be assigned to Compute Engine images. The concern is allAuthenticatedUsers, which grants access to anyone with a Google account, potentially exposing application snapshots and sensitive data.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_image_not_publicly_shared (prowler gcp --checks compute_image_not_publicly_shared).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_compute_image_not_publicly_shared - Prowler Check:
compute_image_not_publicly_shared
Last reviewed: 2026-10-09