# Ensure VM Instance Has Deletion Protection Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888296984291-ensure-vm-instance-has-deletion-protection-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Compute Engine VM instances have the Deletion protection setting enabled so that the instance cannot be accidentally or maliciously deleted without first explicitly disabling this protection.

**Rationale**

Without deletion protection, any principal with sufficient IAM permissions can delete a critical VM instance with a single action, potentially causing significant, immediate service disruption and data loss if the instance's disks are also configured to auto-delete. Enabling deletion protection adds a required, deliberate extra step before an instance can be removed, reducing the risk of accidental deletion through scripting errors, automation mistakes, or console misclicks.

**Impact**

-   Prevents accidental or unauthorized deletion of critical VM instances
    
-   Requires an explicit, deliberate step to disable protection before deletion is possible
    
-   Adds an operational step to legitimate decommissioning workflows, which must account for disabling this setting first
    

**Default Value**

Deletion protection is disabled by default on newly created Compute Engine VM instances.

**Pre-Requisites**

-   IAM permissions to view and edit Compute Engine instance settings (e.g., Compute Instance Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the instance to review.
    
4.  Open the instance details.
    
5.  Verify that Deletion protection is set to On.
    
6.  If Deletion protection is set to Off for a production or critical instance, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the instance to update.
    
4.  Select Edit.
    
5.  Locate the Deletion protection setting and set it to On.
    
6.  Click Save to apply the change.
    
7.  Confirm the instance details now reflect Deletion protection as On.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the affected instance.
    
4.  Select Edit.
    
5.  Locate the Deletion protection setting and set it to Off.
    
6.  Click Save to apply the change.
    

**Reference**

-   [https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion](https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.