​
More Info:

Ensures the total number of VM instances does not exceed a set threshold. The number of running VM instances should be carefully audited, especially in unused regions, to ensure only approved applications are consuming compute resources. Many compromised Google accounts see large numbers of VM instances launched.

​
Risk Level

Low

​
Address

Operational Maturity

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

To remediate the misconfiguration “Total VMs Should Not Exceed Threshold” for GCP using GCP console, follow these steps:
  1. Log in to the GCP console (https://console.cloud.google.com/).
  2. Navigate to the “Compute Engine” section from the left-hand menu.
  3. Click on the “VM instances” tab.
  4. Identify the VM instances that are exceeding the threshold limit.
  5. Select the VM instance that needs to be remediated.
  6. Click on the “Delete” button to delete the instance.
  7. Repeat steps 5 and 6 for all the VM instances that are exceeding the threshold limit.
  8. Once all the VM instances have been deleted, create new instances as needed to meet your requirements, ensuring that the total number of VM instances does not exceed the threshold limit.
Alternatively, you can also set up quotas for the number of VM instances that can be created in your GCP project. This can be done by following these steps:
  1. Go to the “IAM & Admin” section from the left-hand menu.
  2. Click on “Quotas” from the submenu.
  3. Select the quota that needs to be modified (in this case, the quota for the number of VM instances).
  4. Click on the “Edit Quotas” button.
  5. Enter the new quota limit and click on the “Submit Request” button.
  6. Wait for the request to be approved by the GCP team.
Once the new quota limit is approved, you can create new VM instances within the new limit.

​

The Total VMs Should Not Exceed Threshold error in GCP indicates that the total number of virtual machines in a project has exceeded the allowed limit. To remediate this error, you can follow these steps:
  1. Determine the current number of virtual machines in your GCP project using the following command:
gcloud compute instances list --project [PROJECT_ID] | wc -l
Replace [PROJECT_ID] with your GCP project ID.
  1. If the number of virtual machines exceeds the allowed limit, you can delete some of the VMs that are no longer needed. To delete a VM, use the following command:
gcloud compute instances delete [INSTANCE_NAME] --zone [ZONE] --project [PROJECT_ID]
Replace [INSTANCE_NAME] with the name of the VM that you want to delete, [ZONE] with the zone where the VM is located, and [PROJECT_ID] with your GCP project ID.
  1. Repeat step 2 for all the VMs that you want to delete until the total number of VMs in your project is below the allowed limit.
  2. If you need to increase the allowed limit for VMs in your GCP project, you can request a quota increase from GCP support. To do this, go to the GCP Console, select your project, and then click on “IAM & admin” > “Quotas”. Find the quota for “CPUs” and click on the pencil icon to request an increase.
Note: Be careful when deleting VMs as this can result in data loss. Make sure to backup any important data before deleting any VMs.
To remediate the “Total VMs Should Not Exceed Threshold” misconfiguration in GCP using Python, you can follow the below steps:
  1. First, you need to get the total number of VMs in your GCP project using the GCP Python SDK.
from google.cloud import compute_v1

# Create a Compute Engine client object
compute_client = compute_v1.ComputeClient()

# Define the project ID
project_id = 'your-project-id'

# Get the list of all VM instances in the project
instances = compute_client.instances().list(project=project_id).execute()

# Get the total number of VMs
total_vms = len(instances['items'])
  1. Once you have the total number of VMs, you can compare it with the threshold value and take necessary actions to remediate the misconfiguration. For example, you can delete some of the VMs or stop some of the VMs to bring the total number of VMs below the threshold value.
# Define the threshold value
threshold = 10

# Check if the total number of VMs exceeds the threshold value
if total_vms > threshold:
    # Delete or stop some of the VMs to bring the total number of VMs below the threshold value
    # ...
Note: Before deleting or stopping any VMs, make sure to check if they are being used by any critical applications or services. Also, make sure to take appropriate backups and snapshots before making any changes to the VMs.

​
Additional Reading: