Description

Ensure that persistent disks attached to Compute Engine VM instances, particularly non-boot data disks containing important data, have the Auto-delete setting disabled so that the disk is not automatically deleted when the associated instance is deleted.

Rationale

When Auto-delete is enabled on an attached disk, deleting the VM instance also deletes the disk and all data on it, with no separate confirmation for the disk itself. For disks holding important or hard-to-reproduce data, this default behavior increases the risk of accidental, permanent data loss when an instance is deleted as part of routine maintenance, redeployment, or a scripting error.

Impact

  • Preserves data disks after an instance is deleted, preventing accidental data loss

  • Requires a separate, deliberate action to delete a disk that is no longer needed, adding a safeguard against mistakes

  • Can result in orphaned disks that continue to incur storage cost if not cleaned up deliberately after decommissioning

Default Value

By default, the boot disk and any disks attached at instance creation time have Auto-delete enabled.

Pre-Requisites

  • IAM permissions to view and edit Compute Engine instance and disk settings (e.g., Compute Instance Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the instance to review.

  4. Open the instance details and locate the list of attached disks.

  5. For each non-boot data disk, verify whether Auto-delete is disabled.

  6. If a data disk containing important data has Auto-delete enabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the instance to update.

  4. Select Edit.

  5. In the Additional disks section, locate the relevant disk and clear (uncheck) the Delete disk when instance is deleted (Auto-delete) option.

  6. Click Save to apply the change.

  7. Confirm the disk's auto-delete status has been updated in the instance details.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > VM instances and select the affected instance.

  4. Select Edit.

  5. In the Additional disks section, select (check) Delete disk when instance is deleted (Auto-delete) for the relevant disk.

  6. Click Save to apply the change.

Reference