Description

Ensure that Compute Engine VM instances have the Deletion protection setting enabled so that the instance cannot be accidentally or maliciously deleted without first explicitly disabling this protection.

Rationale

Without deletion protection, any principal with sufficient IAM permissions can delete a critical VM instance with a single action, potentially causing significant, immediate service disruption and data loss if the instance's disks are also configured to auto-delete. Enabling deletion protection adds a required, deliberate extra step before an instance can be removed, reducing the risk of accidental deletion through scripting errors, automation mistakes, or console misclicks.

Impact

  • Prevents accidental or unauthorized deletion of critical VM instances

  • Requires an explicit, deliberate step to disable protection before deletion is possible

  • Adds an operational step to legitimate decommissioning workflows, which must account for disabling this setting first

Default Value

Deletion protection is disabled by default on newly created Compute Engine VM instances.

Pre-Requisites

  • IAM permissions to view and edit Compute Engine instance settings (e.g., Compute Instance Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the instance to review.

  4. Open the instance details.

  5. Verify that Deletion protection is set to On.

  6. If Deletion protection is set to Off for a production or critical instance, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the instance to update.

  4. Select Edit.

  5. Locate the Deletion protection setting and set it to On.

  6. Click Save to apply the change.

  7. Confirm the instance details now reflect Deletion protection as On.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the affected instance.

  4. Select Edit.

  5. Locate the Deletion protection setting and set it to Off.

  6. Click Save to apply the change.

Reference