> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP workload scanning coverage

> What GCP workload scanning does and doesn't scan today, and why each excluded case is excluded

This page is the canonical reference for what workload scanning covers. Where an asset can't be scanned, the reason is listed here, and the same reason appears next to the asset in the Plerion dashboard, so a gap is never silent.

***

## Supported today

| Asset                                                | Support                              |
| ---------------------------------------------------- | ------------------------------------ |
| Compute Engine VM instance, standard persistent disk | Fully supported                      |
| Compute Engine VM instance, CMEK-encrypted disk      | Supported, with a caveat (see below) |

***

## Not supported, with reasons

| Asset                                                          | Why                                                                                              | Notes                                                                                                                                                                      |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Local SSD**                                                  | Local SSD disks can't be snapshotted by GCP                                                      | No workaround: this is a platform limitation, not a Plerion one                                                                                                            |
| **Confidential VMs**                                           | Excluded by design                                                                               | Matches the exclusion Google's own Security Command Center applies to its scanner                                                                                          |
| **CSEK-encrypted disks**                                       | Plerion has no way to supply a customer-supplied encryption key during snapshot or disk creation | No decryption path exists for this case                                                                                                                                    |
| **GKE nodes**                                                  | Not scanned as Compute Engine instances                                                          | Kubernetes workloads running on GKE (pods, deployments, and similar objects) are covered by the [Kubernetes integration](/guides/integrations/kubernetes/overview) instead |
| **Cloud Functions, Cloud Run, managed instance groups (MIGs)** | Not yet supported                                                                                | Planned for a future release; v1 covers Compute Engine VM instances only                                                                                                   |
| **Projects with the Compute Engine API disabled**              | Plerion can't list VM instances in a project that has never enabled `compute.googleapis.com`     | The project is skipped for workload scanning only. Its posture scanning is unaffected, so you'll still see findings for it, just no vulnerabilities                        |

A VM that falls into one of these categories is skipped with the reason above shown against it, never silently dropped from results.

<Note>
  Google-managed projects are excluded from Plerion entirely, not just from workload scanning. See [Projects Plerion does not scan](/guides/integrations/gcp/overview#projects-plerion-does-not-scan).
</Note>

***

## CMEK-encrypted disks: supported, encryption-stripped

Workload scanning does scan VMs backed by a customer-managed encryption key (CMEK). The snapshot it takes inherits your key, but the scan disk created from that snapshot in the scanning project carries **Google-managed encryption instead of your key**: Plerion isn't granted, and doesn't need, access to decrypt with your CMEK key to create it.

This means CMEK-backed VMs get full scan coverage, with one disclosed trade-off: for the short window the scan disk exists, its confidentiality boundary is Google-managed rather than customer-managed. See [How scanning works](/guides/integrations/gcp/workload-scanning/how-scanning-works#encrypted-disks) for the full mechanics.

Tagging a project `PlerionAccess: Denied` (see the [GCP integration overview](/guides/integrations/gcp/overview#controlling-cmek-access-per-project)) removes Plerion's own Cloud KMS access to that project. It is a key-access control, not a scanning one: project selection is what decides which projects Plerion scans.

To stop scanning a project, exclude it from the organization integration's project selection under **Manage projects**.

<Warning>
  Excluding a project that is already onboarded deletes its integration and all of the findings and scan history Plerion holds for it. This cannot be undone, and it stops posture scanning as well as workload scanning. Plerion asks you to confirm before doing it. Excluding a project that has not been onboarded yet simply prevents it from ever being added.
</Warning>

***

## Regions

Workload scanning always creates the scan disk and scanner VM in the **same region** as the source disk. Cross-region scanning never happens. If you've limited scanning to specific regions with the **workload regions** setting, VMs outside those regions are skipped as out of scope, not as a coverage gap; see [Managing workload scanning](/guides/integrations/gcp/workload-scanning/managing-workload-scanning#workload-regions).

***

## What's next

Cloud Functions, Cloud Run, and MIGs are the next workload types planned. This page will be updated as coverage expands.

***

## Next step

* [Managing workload scanning](/guides/integrations/gcp/workload-scanning/managing-workload-scanning)