# Ensure VM Instance Attached Disks Have Auto-Delete Disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888297686685-ensure-vm-instance-attached-disks-have-auto-delete-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that persistent disks attached to Compute Engine VM instances, particularly non-boot data disks containing important data, have the Auto-delete setting disabled so that the disk is not automatically deleted when the associated instance is deleted.

**Rationale**

When Auto-delete is enabled on an attached disk, deleting the VM instance also deletes the disk and all data on it, with no separate confirmation for the disk itself. For disks holding important or hard-to-reproduce data, this default behavior increases the risk of accidental, permanent data loss when an instance is deleted as part of routine maintenance, redeployment, or a scripting error.

**Impact**

-   Preserves data disks after an instance is deleted, preventing accidental data loss
    
-   Requires a separate, deliberate action to delete a disk that is no longer needed, adding a safeguard against mistakes
    
-   Can result in orphaned disks that continue to incur storage cost if not cleaned up deliberately after decommissioning
    

**Default Value**

By default, the boot disk and any disks attached at instance creation time have Auto-delete enabled.

**Pre-Requisites**

-   IAM permissions to view and edit Compute Engine instance and disk settings (e.g., Compute Instance Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the instance to review.
    
4.  Open the instance details and locate the list of attached disks.
    
5.  For each non-boot data disk, verify whether Auto-delete is disabled.
    
6.  If a data disk containing important data has Auto-delete enabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the instance to update.
    
4.  Select Edit.
    
5.  In the Additional disks section, locate the relevant disk and clear (uncheck) the Delete disk when instance is deleted (Auto-delete) option.
    
6.  Click Save to apply the change.
    
7.  Confirm the disk's auto-delete status has been updated in the instance details.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Compute Engine > VM instances and select the affected instance.
    
4.  Select Edit.
    
5.  In the Additional disks section, select (check) Delete disk when instance is deleted (Auto-delete) for the relevant disk.
    
6.  Click Save to apply the change.
    

**Reference**

-   [https://cloud.google.com/compute/docs/disks/add-persistent-disk](https://cloud.google.com/compute/docs/disks/add-persistent-disk)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.