Skip to main content
orphan · gcp

GCP Old Disk Snapshot

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

GCE disk snapshots older than 90 days are flagged for retention review. A source-disk-deleted flag also qualifies, though no producer stamps that flag today. Savings equal the snapshot's storage cost, GB times the per-GB rate; unreadable creation timestamps or missing pricing cause the rule to abstain.

Signal and threshold

How ZopNight evaluates GCP Old Disk Snapshot.
Field Value
Rule IDsRC-143
Categoryorphan
Severitylow
Metricnone — pure configuration read
Sourcedisk_snapshot_old.go

Creation timestamp, with a deleted-source hook

  • resource.Metadata: creation_timestamp (canonical sink, written by buildSnapshotMetadata), with a fallback read of the same key from resource.Tags (legacy mirror, mapGCPSnapshot). RFC3339 and date-only (2006-01-02) formats are both accepted. Abstains when neither sink yields a timestamp or a firing signal.
  • resource.Metadata: source_disk_deleted==“true” (via MetadataStateMatches, Metadata-only, fail-safe): a forward-compatible orphan hook. No producer stamps this per-snapshot flag today: the GCP discoverer (gcp/snapshot.go) only ever emits a standalone gcp-snapshot when the source disk still exists; a snapshot whose source disk was deleted is instead rolled into the separate gcp-snapshot-orphan aggregate type. The branch stays wired for when/if a per-snapshot flag is added, but never fabricates a signal.
  • Fires when source_disk_deleted==“true” or age > 90 days; abstains on existence alone, on an unreadable timestamp, or when GB×rate pricing is missing/zero.

Snapshot storage priced per GB

fixed estimate: snapshot storage cost (GB × per-GB rate) looked up by resource UID; abstains (no recommendation) when pricing is unavailable or zero.

Deleting past retention, then automating it

  1. Open Compute Engine Console → Snapshots
  2. Review the creation date and source disk of each snapshot
  3. Verify the source disk still exists and the snapshot is within your retention policy
  4. Delete snapshots that are beyond retention or whose source disk has been deleted
  5. Consider using snapshot schedules to automate retention management

No metrics, just age past 90 days

None (gate: source-disk-deleted flag OR creation age > 90d, read Metadata-first with Tags fallback for age; STORAGE snapshot GB × rate, concrete-or-abstain)

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·