Compute Engine instances should have write permissions on deny policies restricted
This control ensures that Compute Instance does not allow write permission on deny policies. The powerpipe check is titled "Compute Instances should restrict write permission on deny policy".
What this control checks
Compute Instances should restrict write permission on deny policy
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_instance_no_write_permission_on_deny_policy.
Related controls
- Compute Engine instances should have data destruction permissions restricted
- Cloud Functions should not have roles/editor or roles/owner permissions
- IAM users should not hold both service account admin and service account user roles
- IAM policies should not grant access to 'allUsers' or 'allAuthenticatedUsers'
- Service accounts should be used within the configured maximum unused period
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_no_write_permission_on_deny_policy - Powerpipe Control:
gcp_compliance.control.compute_instance_no_write_permission_on_deny_policy
Last reviewed: 2026-10-09