Compute Engine disk snapshots should not be outdated
Compute Engine disk snapshots are evaluated against a configurable age threshold (default `90` days). The check identifies snapshots exceeding the organization's retention policy. Prowler marks it with low severity.
Outdated snapshots containing sensitive data expand the attack surface and risk data exposure if compromised. Stale snapshots may violate compliance requirements, complicate disaster recovery efforts, and introduce configuration drift that affects system integrity.
What this control checks
Compute Engine disk snapshots must not be older than an allowed age limit
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_snapshot_not_outdated (prowler gcp --checks compute_snapshot_not_outdated).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_compute_snapshot_not_outdated - Prowler Check:
compute_snapshot_not_outdated
Last reviewed: 2026-10-09