Configure the recycle bin retention policy

By default, Compute Engine retains deleted standard snapshots in the recycle bin for a three-day retention period before permanently erasing the snapshots. You can configure a shorter retention period or disable the recycle bin by modifying the recycle bin retention policy.

This document describes how to view and configure the recycle bin retention policy.

To view the contents of a recycle bin or to recover a snapshot from the recycle bin, see Manage the recycle bin.

Before you begin

• If you haven't already, set up authentication. Authentication verifies your identity for access to Cloud de Confiance by S3NS services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  Console

  When you use the Cloud de Confiance console to access Cloud de Confiance by S3NS services and APIs, you don't need to set up authentication.

  gcloud

  1. Install the Google Cloud CLI, and then sign in to the gcloud CLI with your federated identity. After signing in, initialize the Google Cloud CLI by running the following command:

     gcloud init

  2. Set a default region and zone.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI, and then sign in to the gcloud CLI with your federated identity.

  For more information, see Authenticate for using REST in the Cloud de Confiance authentication documentation.

Required roles and permissions

To get the permissions that you need to view and manage the recycle bin retention policy, ask your administrator to grant you the Compute Admin (roles/compute.admin) IAM role on the project. For more information about granting roles, see Manage access to projects, folders, and organizations.

This predefined role contains the permissions required to view and manage the recycle bin retention policy. To see the exact permissions that are required, expand the Required permissions section:

You might also be able to get these permissions with custom roles or other predefined roles.

How the recycle bin retention policy works

The recycle bin retention policy is a global collection of rules that define the retention period for standard snapshots across all projects and organizations.

The recycle bin retention policy has the following features:

• The three-day default retention period is called the system default rule. You can't remove the system default rule, but you can override it.

• To override the system default rule, you can add project or organization default rules that apply to a project or organization, respectively. You can also add tag-based rules to the recycle bin retention policy.

• Rule conflicts in the retention policy are resolved as follows:

  1. Tag-based rules override both project and organization default rules.
  2. If multiple tag-based rules apply to a standard snapshot, then the rule with the longest retention period applies. However, a project default rule won't override a tag-based rule even if the former has a longer retention period.
  3. Project default rules override the organization default rule.
  4. If no rules apply to a standard snapshot, then the system default rule applies.

  For more information, see Hierarchy of rules within the recycle bin retention policy.

• Although Google doesn't recommend disabling the recycle bin, you can do so for a project, organization, or tag by creating a rule with a zero-day retention period. All standard snapshots that are subject to the rule are immediately erased when you delete them.

• Changes to the recycle bin retention policy don't apply to existing recoverable snapshots, that is, existing deleted standard snapshots that are in the recycle bin.

Limitations

• Only standard snapshots are supported. Archive snapshots, instant snapshots, disks, and images are immediately permanently erased upon deletion.
• Changes to the recycle bin retention policy don't apply to existing recoverable snapshots, that is, existing deleted standard snapshots that are in the recycle bin.
• To specify a retention policy rule for a tag, the tag must already exist.
• You can set retention policy rules for only projects, organizations, or tags.
• If you set a retention policy rule for a tag, the retention policy only applies to standard snapshots that have that tag. Archive snapshots, instant snapshots, disks, and any other resources that have that tag aren't compatible with the recycle bin and are permanently erased when you delete them.

Set or remove the default retention period for a project or organization

To override the three-day system default rule within a project or organization or to disable the recycle bin, set the default retention policy rule for the project or organization.

You can use the gcloud CLI or REST.

Set or remove the retention policy for a tag

To set a specific retention period for standard snapshots that have a specific tag, set a tag-based rule at the project or organization level. Tag based rules override the default rule for a project or organization and have the following characteristics:

• Tag-based rules at the organization or project level apply to all the standard snapshots within the organization or project, respectively, that have the tag.

• Project-level tag rules override organization-level tag rules only if the project-level rule has a longer retention period.

  For example, an organization-level tag rule with a two-day retention period overrides a one-day project-level tag rule.

For more information, see Hierarchy of rules within the recycle bin retention policy.

You can use the gcloud CLI or REST.

gcloud beta compute snapshot-recycle-bin-policy update \
  --set-rule=TAG_NAMESPACED_NAME \
  --standard-snapshots-retention-duration-days=RETENTION_PERIOD_DAYS \
  --organization=ORGANIZATION_ID

gcloud beta compute snapshot-recycle-bin-policy update \
  --organization=ORGANIZATION_ID \
  --remove-rule=TAG_NAMESPACED_NAME

PATCH https://compute.s3nsapis.fr/compute/beta/projects/PROJECT_ID/global/snapshotRecycleBinPolicy/
{
  "rules": {
    "TAG_NAMESPACED_NAME_1": {
      "standardSnapshots": { 
        "retentionDurationDays": RETENTION_PERIOD_DAYS
      }
    }
  }
}

PATCH https://compute.s3nsapis.fr/compute/beta/organizations/ORGANIZATION_ID/global/snapshotRecycleBinPolicy/

PATCH https://compute.s3nsapis.fr/compute/beta/projects/PROJECT_ID/global/snapshotRecycleBinPolicy
{
  "rules": {
    "TAG_NAMESPACED_NAME_1": null
  }
}

View the recycle bin retention policy for a project or organization

To determine if a project or organization has custom rules for the recycle bin, view any tag-based rules, or check if the recycle bin is disabled, view the rules in the project or organization's recycle bin retention policy.

To view the rules in a project or organization's recycle bin retention policy, use the gcloud CLI or REST.

  rules:
    default:
      standardSnapshots:
        retentionDurationDays: '2'
    database-project/Testing-tag-key/build:
      standardSnapshots:
        retentionDurationDays: '0'
    database-project/Testing-tag-key/critical:
      standardSnapshots:
        retentionDurationDays: '5'
    systemRules:
      default:
        standardSnapshots:
          retentionDurationDays: '3'

  {
    "rules": {
     "default": {
      "standardSnapshots": {
        "retentionDurationDays": "2"
      }
    },
    "database-project/Testing-tag-key/build": {
      "standardSnapshots": {
        "retentionDurationDays": "0"
      }
    },
    "database-project/Testing-tag-key/critical": {
      "standardSnapshots": {
        "retentionDurationDays": "5"
      }
    },
     "systemRules": {
      "default": {
       "standardSnapshots": {
         "retentionDurationDays": "3"
      }
     }
    }
  }
 }

If the retention period is zero, then Compute Engine will permanently erase the snapshot immediately after it is deleted. Otherwise, the retention period indicates how long Compute Engine will retain the snapshot in the recycle bin before permanently erasing it.

View the recycle bin retention period for a tag

To view the retention policy for a tag, retrieve the retention policy for the project or organization where the tag is defined.

Check the recycle bin retention period for a specific snapshot

To determine if a standard snapshot will be retained in the recycle bin, if it is deleted, and for how long, check its retention period. If the retention period is zero, then the snapshot will be permanently erased immediately after it is deleted. Otherwise, the retention period indicates how long the snapshot will be retained in the recycle bin if it is deleted.

You can check the retention period for a specific snapshot by using the Cloud de Confiance console, gcloud CLI, or REST.

gcloud beta compute snapshots get-effective-recycle-bin-rule \
  SNAPSHOT_NAME \
  --project=PROJECT_ID

retentionDurationDays: '5'

GET https://compute.s3nsapis.fr/compute/beta/projects/PROJECT_ID/global/snapshots/SNAPSHOT_NAME/getEffectiveRecycleBinRule

{
  "retentionDurationDays": "5"
}

If the retention period is zero, then Compute Engine will permanently erase the snapshot immediately after it is deleted. Otherwise, the retention period indicates how long Compute Engine will retain the snapshot in the recycle bin before permanently erasing it.

To determine which rules in the retention policy apply to the snapshot, compare the snapshot's tags to the tags and the default rule in the retention policy for the project and organization.

To change the retention period for a standard snapshot, choose one of the following options:

• Create a tag-based rule for one of the snapshot's tags
• If an appropriate tag-based rule already exists, add that tag to the snapshot by following the instructions in Add tags to a resource.
• Change the default recycle bin retention rule for the project or organization, but note that this will apply to all other standard snapshots in the project or organization.

What's next

• Recover a snapshot from the recycle bin
• To manage tags for a standard snapshot, see Adding tags to a resource