Compute Engine instances should have deletion protection enabled
This check verifies whether GCP Compute Engine VM instances have deletion protection enabled. Deletion protection prevents accidental termination of production or critical workloads.
Without deletion protection enabled, VM instances are vulnerable to accidental deletion by users with sufficient permissions. This could result in: Service disruption and downtime for critical applications. Data loss if persistent disks are also deleted.
What this control checks
Compute Engine instances should have deletion protection enabled
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_instance_deletion_protection_enabled (prowler gcp --checks compute_instance_deletion_protection_enabled).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_compute_instance_deletion_protection_enabled - Prowler Check:
compute_instance_deletion_protection_enabled
Last reviewed: 2026-10-09