Description

Ensure that Compute Engine persistent disk snapshots used for backup and recovery purposes are refreshed regularly, and that outdated snapshots which no longer reflect a recent, restorable state of the disk are identified and replaced or removed as part of a defined snapshot schedule.

Rationale

A snapshot that has not been refreshed in a long time reflects an old state of the disk, which may not accurately represent current data for recovery purposes and can create a false sense of protection when a more recent restore point does not actually exist. Regularly scheduled, current snapshots ensure that recovery objectives (RPO) can actually be met, and outdated snapshots that are no longer useful should be identified and cleaned up to avoid unnecessary storage cost and confusion during a recovery event.

Impact

  • Ensures backup snapshots reflect a recent, restorable state of the disk, supporting recovery point objectives

  • Reduces the risk of relying on a stale snapshot during an actual recovery event

  • Reduces unnecessary storage cost from retaining old, superseded snapshots indefinitely

Default Value

Google Cloud does not automatically create or refresh snapshots; snapshot creation and retention must be configured through a snapshot schedule, and there is no default age at which a snapshot is considered outdated unless defined by policy.

Pre-Requisites

  • A documented snapshot schedule and retention policy defining the maximum acceptable snapshot age for each disk

  • IAM permissions to view and manage snapshots and snapshot schedules (e.g., Compute Storage Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Storage > Snapshots.

  4. Review the Creation date of the most recent snapshot for each critical disk.

  5. Compare the most recent snapshot's age against the organization's documented maximum acceptable snapshot age.

  6. Verify that a resource policy (snapshot schedule) is attached to the disk to ensure ongoing, automatic snapshot creation.

  7. If the most recent snapshot exceeds the acceptable age, or no snapshot schedule exists, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Storage > Snapshots > Snapshot schedules and select Create snapshot schedule.

  4. Define the schedule frequency (for example, daily), the region for storing snapshots, and the retention policy for how many snapshots to keep.

  5. Attach the snapshot schedule to the relevant persistent disk(s) under Compute Engine > Storage > Disks.

  6. For disks with an existing but outdated manual snapshot, trigger a fresh manual snapshot immediately, and confirm the new snapshot appears with a current creation date.

  7. Delete or archive clearly outdated, superseded snapshots that fall outside the retention policy, if not already handled automatically by the schedule.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Compute Engine > Storage > Snapshots > Snapshot schedules and select the schedule to remove.

  4. Detach the schedule from the disk, or delete the schedule.

Reference