Skip to main content

Total VMs Should Not Exceed Threshold

More Info:​

Ensures the total number of VM instances does not exceed a set threshold. The number of running VM instances should be carefully audited, especially in unused regions, to ensure only approved applications are consuming compute resources. Many compromised Google accounts see large numbers of VM instances launched.

Risk Level​

Low

Address​

Operational Maturity

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "Total VMs Should Not Exceed Threshold" for GCP using GCP console, follow these steps:

  1. Log in to the GCP console (https://console.cloud.google.com/).
  2. Navigate to the "Compute Engine" section from the left-hand menu.
  3. Click on the "VM instances" tab.
  4. Identify the VM instances that are exceeding the threshold limit.
  5. Select the VM instance that needs to be remediated.
  6. Click on the "Delete" button to delete the instance.
  7. Repeat steps 5 and 6 for all the VM instances that are exceeding the threshold limit.
  8. Once all the VM instances have been deleted, create new instances as needed to meet your requirements, ensuring that the total number of VM instances does not exceed the threshold limit.

Alternatively, you can also set up quotas for the number of VM instances that can be created in your GCP project. This can be done by following these steps:

  1. Go to the "IAM & Admin" section from the left-hand menu.
  2. Click on "Quotas" from the submenu.
  3. Select the quota that needs to be modified (in this case, the quota for the number of VM instances).
  4. Click on the "Edit Quotas" button.
  5. Enter the new quota limit and click on the "Submit Request" button.
  6. Wait for the request to be approved by the GCP team.

Once the new quota limit is approved, you can create new VM instances within the new limit.

Using CLI

The Total VMs Should Not Exceed Threshold error in GCP indicates that the total number of virtual machines in a project has exceeded the allowed limit. To remediate this error, you can follow these steps:

  1. Determine the current number of virtual machines in your GCP project using the following command:
gcloud compute instances list --project [PROJECT_ID] | wc -l

Replace [PROJECT_ID] with your GCP project ID.

  1. If the number of virtual machines exceeds the allowed limit, you can delete some of the VMs that are no longer needed. To delete a VM, use the following command:
gcloud compute instances delete [INSTANCE_NAME] --zone [ZONE] --project [PROJECT_ID]

Replace [INSTANCE_NAME] with the name of the VM that you want to delete, [ZONE] with the zone where the VM is located, and [PROJECT_ID] with your GCP project ID.

  1. Repeat step 2 for all the VMs that you want to delete until the total number of VMs in your project is below the allowed limit.

  2. If you need to increase the allowed limit for VMs in your GCP project, you can request a quota increase from GCP support. To do this, go to the GCP Console, select your project, and then click on "IAM & admin" > "Quotas". Find the quota for "CPUs" and click on the pencil icon to request an increase.

Note: Be careful when deleting VMs as this can result in data loss. Make sure to backup any important data before deleting any VMs.

Using Python

To remediate the "Total VMs Should Not Exceed Threshold" misconfiguration in GCP using Python, you can follow the below steps:

  1. First, you need to get the total number of VMs in your GCP project using the GCP Python SDK.
from google.cloud import compute_v1

# Create a Compute Engine client object
compute_client = compute_v1.ComputeClient()

# Define the project ID
project_id = 'your-project-id'

# Get the list of all VM instances in the project
instances = compute_client.instances().list(project=project_id).execute()

# Get the total number of VMs
total_vms = len(instances['items'])
  1. Once you have the total number of VMs, you can compare it with the threshold value and take necessary actions to remediate the misconfiguration. For example, you can delete some of the VMs or stop some of the VMs to bring the total number of VMs below the threshold value.
# Define the threshold value
threshold = 10

# Check if the total number of VMs exceeds the threshold value
if total_vms > threshold:
    # Delete or stop some of the VMs to bring the total number of VMs below the threshold value
    # ...

Note: Before deleting or stopping any VMs, make sure to check if they are being used by any critical applications or services. Also, make sure to take appropriate backups and snapshots before making any changes to the VMs.

Using Terraform
# This control (a hard cap on the *total* number of running VM instances in a
# project/region) cannot be enforced directly on gcp-compute-computeengine-instance
# via Terraform, because Google Cloud does not expose a VM-count quota knob for
# Compute Engine instances through the Terraform provider.

# What you *can* do in Terraform is:
# - Ensure that all VMs are created only via Terraform, and
# - Enforce that your Terraform configuration never creates more than the
#   allowed threshold of instances (here: 50).

variable "instance_count" {
  description = "Number of Compute Engine instances to create via Terraform."
  type        = number

  validation {
    condition     = var.instance_count <= 50
    error_message = "instance_count exceeds the allowed maximum of 50 instances."
  }
}

resource "google_compute_instance" "vm" {
  count        = var.instance_count
  name         = "VM_NAME-${count.index}"  # replace VM_NAME with a base name
  machine_type = "MACHINE_TYPE"            # e.g. n1-standard-1
  zone         = "ZONE"                    # e.g. us-central1-a

  boot_disk {
    initialize_params {
      image = "BOOT_DISK_IMAGE"            # e.g. debian-cloud/debian-11
    }
  }

  network_interface {
    network = "NETWORK_NAME"               # e.g. default
  }
}

This does not stop VMs created outside Terraform or enforce the max at runtime; to fully remediate, you must also audit and delete excess instances in the Google Cloud Console and/or restrict who can create compute.instances.create outside Terraform.

terraform plan should show at most var.instance_count (≤ 50) google_compute_instance.vm resources being created or managed; if a higher value is set, Terraform will fail validation before planning.