# Ensure Compute Engine Disk Image is Not Publicly Shared

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888295106195-ensure-compute-engine-disk-image-is-not-publicly-shared
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that custom Compute Engine disk images do not grant the allUsers or allAuthenticatedUsers principal any IAM role (such as Compute Image User) that would make the image accessible to the public or to any authenticated Google account.

**Rationale**

A publicly shared custom disk image may expose sensitive information baked into the image, such as application code, configuration files, credentials, or proprietary software, to any Google Cloud user (or, if shared with allUsers, any internet user). Images should only be shared with specific, intended projects or identities within the organization.

**Impact**

-   Prevents exposure of proprietary software, configuration, or embedded credentials contained in a custom image
    
-   Restricts image usage to explicitly authorized projects and identities
    
-   Reduces the risk of an external party creating instances from an organization's custom image
    

**Default Value**

By default, newly created custom disk images are private and are not shared with allUsers or allAuthenticatedUsers.

**Pre-Requisites**

-   IAM permissions to view and edit IAM policies on Compute Engine images (e.g., Compute Image Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > Storage > Images.
    
4.  Select the image to review, then open the Permissions tab.
    
5.  Review the list of principals granted access to the image.
    
6.  Verify that allUsers and allAuthenticatedUsers do not appear with any role.
    
7.  If either principal is present, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > Storage > Images and select the affected image.
    
4.  Open the Permissions tab.
    
5.  Locate the allUsers or allAuthenticatedUsers entry and select Remove access.
    
6.  Confirm the removal.
    
7.  If specific external projects legitimately require access, grant the Compute Image User role to their specific service accounts or project identities instead of using public principals.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > Storage > Images and select the affected image.
    
4.  Open the Permissions tab and select Add principal.
    
5.  Add allUsers or allAuthenticatedUsers back with the Compute Image User role.
    
6.  Save the change.
    

**Reference**

-   [https://cloud.google.com/compute/docs/images/sharing-images-across-projects](https://cloud.google.com/compute/docs/images/sharing-images-across-projects)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.