Ensure that Virtual Machine instances have deletion protection enabled.
Risk Level: Medium
Description
This plugin ensures that Virtual Machine instances have deletion protection enabled. The deletion protection feature allows users to prevent accidental deletion of the VM instances. When it is enabled, if a user attempts to delete the instance, the request fails.
About the Service
Google Cloud Compute Engine:
Google Cloud Compute Engine is a service that allows you to create Virtual Machines based on your preferences and run them on Google’s infrastructure. You can either use their predefined machines with certain default configurations or create your own custom Virtual Machine to meet your exact requirements. To know more, read here.
Impact
If an instance has deletion protection disabled, it poses a great risk of those instances getting deleted accidentally. This could result in permanently losing all the important data present in that particular instance.
Steps to Reproduce
Using GCP Console-
- Log In to your GCP Console.
- From the top navigation bar, select the GCP project you want to investigate.
- From the navigation panel on the left side of the console, go to Compute Engine and select VM Instances. You can use this link (https://console.cloud.google.com/compute) to navigate directly if you’re already logged in.
- Select the VM instance you want to investigate from the list of instances and go to the Details tab to examine the details of the VM instance selected.
- Scroll down to the Deletion protection section and check the delete protection setting status. If it is disabled, then it means that this Google Cloud virtual machine (VM) instance isn't safeguarded against accidental deletion.
- Repeat steps 4 and 5 for all the VM instances you want to investigate in the selected project.
- If you have multiple projects that you want to investigate, repeat steps 2-6 for each project in your GCP console.
Steps for Remediation
Determine whether or not you truly require deletion protection to be disabled. If not, make the necessary changes to enable deletion protection of your VM instances.
The steps to enable deletion protection are-
Using GCP Console-
- Log In to your GCP Console.
- From the top navigation bar, select the GCP project you want to investigate.
- From the navigation panel on the left side of the console, go to Compute Engine and select VM Instances. You can use this link (https://console.cloud.google.com/compute) to navigate directly if you’re already logged in.
- From the list of instances, choose the VM instance you want to reconfigure. (In case you aren’t sure which instance needs to be configured, follow the steps to reproduce listed above to determine which instance to choose.)
- Select the Edit option from the top navigation bar of the VM instance details page.
- Scroll down to the Deletion protection section and check the Enable deletion protection checkbox to enable deletion protection for the VM instance.
- Repeat steps 5 and 6 for all the VM instances you want to reconfigure in the selected project.
- If you have multiple projects, repeat steps 2-7 for each project in your GCP console