Use the Knowledge Base AI to help improve your Cloud Posture

Enable Deletion Protection for Filestore Instances

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that your Google Cloud Filestore instances have Deletion Protection feature enabled in order to protect them from being accidentally deleted.

Security

With the Deletion Protection safety feature enabled, your Filestore instances are guaranteed to be protected from accidental deletion, ensuring your data remains safe. Deletion protection prevents any existing or new Filestore instances from being deleted by any users through the Google Cloud Management Console, CLI, or API calls, unless the feature is explicitly disabled.


Audit

To determine if your Google Cloud Filestore instances are protected against accidental or unauthorized deletion, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to examine from the console top navigation bar.

03 Navigate to Filestore console available at https://console.cloud.google.com/filestore/.

04 In the left navigation panel, choose Instances to access the list of Google Cloud Filestore instances provisioned for the selected GCP project.

05 Click on the ID (link) of the Filestore instance that you want to examine. A Filestore instance is a fully-managed, network-attached storage system that you can use with Compute Engine and Kubernetes Engine instances.

06 Select the OVERVIEW tab to view the configuration information available for the selected instance.

07 Check the Deletion protection attribute value to determine the safety feature status for your instance. If the Deletion protection attribute value is set to Disabled, the Deletion Protection safety feature is not enabled for the selected Google Cloud Filestore instance.

08 Repeat step no. 5 - 7 for each Filestore instance available within the selected GCP project.

09 Repeat steps no. 2 - 8 for each GCP project deployed within your Google Cloud account.

Using GCP CLI

01 Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each project available in your Google Cloud Platform (GCP) account:

gcloud projects list
	--format="table(projectId)"

02 The command output should return the requested GCP project IDs:

PROJECT_ID
cc-web-project-123123
cc-cloudai-project-112233

03 Run filestore instances list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to list the Google Cloud Filestore instances deployed to the selected project:

gcloud filestore instances list
	--project cc-web-project-123123
	--format="default(name)"

04 The command request should return the requested instance IDs (i.e., fully qualified identifiers):

name: projects/cc-web-project-123123/locations/us-central1-a/instances/cc-gce-filestorage-instance
name: projects/cc-web-project-123123/locations/us-central1-a/instances/cc-web-filestorage-instance

05 Run filestore instances describe command (Windows/macOS/Linux) with the ID of the Filestore instance that you want to examine as the identifier parameter, to determine if the selected instance is protected against accidental or unauthorized deletion:

gcloud filestore instances describe "projects/cc-web-project-123123/locations/us-central1-a/instances/cc-gce-filestorage-instance"
	--format="yaml(deletionProtectionEnabled)"

06 The command output should return the Deletion Protection feature for the selected instance:

null

If the filestore instances describe command output returns null, as shown in the example above, the Deletion Protection safety feature is not enabled for the selected Google Cloud Filestore instance.

07 Repeat steps no. 5 and 6 for each Filestore instance available in the selected GCP project.

08 Repeat steps no. 3 – 7 for each GCP project deployed in your Google Cloud account.

Remediation / Resolution

To enable the Deletion Protection feature for your Google Cloud Filestore instances and ensure protection against accidental or unauthorized deletion, perform the following operations:

Using GCP Console

01 Sign in to the Google Cloud Management Console.

02 Select the Google Cloud Platform (GCP) project that you want to access from the console top navigation bar.

03 Navigate to Filestore console available at https://console.cloud.google.com/filestore/.

04 In the left navigation panel, choose Instances to access the list of Google Cloud Filestore instances provisioned for the selected GCP project.

05 Click on the ID (link) of the Filestore instance that you want to configure and choose EDIT to modify the instance configuration.

06 Under Deletion protection, check the Enable deletion protection setting checkbox and provide a reason for that in the Reason (optional) box. Choose SAVE to apply the changes. This will enable the Deletion Protection feature for the selected Google Cloud Filestore instance.

07 Repeat step no. 5 and 6 for each Filestore instance that you want to configure, available within the selected GCP project.

08 Repeat steps no. 2 - 7 for each GCP project available within your Google Cloud account.

Using GCP CLI

01 Run the filestore instances update command (OSX/Linux/UNIX) with the ID of the Filestore instance that you want to configure as the identifier parameter, to enable the Deletion Protection safety feature for the selected instance:

gcloud filestore instances update "projects/cc-web-project-123123/locations/us-central1-a/instances/cc-gce-filestorage-instance"
	--deletion-protection

02 The command output should return the update operation status:

Waiting for [operation-123456789012-abcd1234abcd-1234abcd-1234abcd] to finish... done.

03 Repeat steps no. 1 and 2 for each Filestore instance that you want to configure, available in the selected GCP project.

04 Repeat steps no. 1 – 3 for each GCP project available in your Google Cloud account.

References

Publication date Jan 17, 2025