MEDIUM
Source
CloudSploit
ID
vm-max-instances

VM Max Instances

Ensures the total number of VM instances does not exceed a set threshold

The number of running VM instances should be carefully audited, especially in unused regions, to ensure only approved applications are consuming compute resources. Many compromised Google accounts see large numbers of VM instances launched.

Ensure that the number of running VM instances matches the expected count. If instances are launched above the threshold, investigate to ensure they are legitimate.