Skip to main content
Workload scanning is managed from the same GCP organization integration’s detail page as the rest of the integration. This page covers the ongoing operations: re-running onboarding, scoping which regions are scanned, and turning the capability off or removing it.

​
Re-running onboarding

The onboarding script and Terraform template are safe to run again at any time. Re-running either one:
  • Picks up any new permissions Plerion has added to the workload scanning roles since you last ran it.
  • Converges the scanning project’s configuration if it was only partially created: the script finds the existing project by its plerion-scan=true label and fixes whatever’s missing, rather than creating a duplicate.
  • Applies a changed billing account, if you pass a different --billing-account value.
You don’t need to delete anything first. If Plerion’s edit dialog shows an expanded access warning after you change a capability, re-running the script or Terraform apply is exactly what resolves it.

​
Workload regions

Use Limit scanning to specific regions in the wizard or edit dialog to restrict workload scanning to an allowlist of regions. This is a pure scan-scope filter. It doesn’t provision any region-specific infrastructure ahead of time. Leave it empty to scan workloads wherever they’re found; scan disks and scanner VMs are always created on demand, in whichever region a scan is currently running in. Changing this setting takes effect on the next scan cycle, but it doesn’t retroactively affect a scan already in progress.

​
Cost

You pay for scanning compute directly, in the scanning project’s own billing; there’s no separate Plerion metering or invoice for it. What drives cost:
  • Scanner VM time: a typical VM scan costs a small amount of compute time. The scan is bounded by a 120-minute hard timeout, so a single scan’s cost has a firm ceiling.
  • Snapshot and scan disk storage: both are short-lived (deleted at the end of the scan) and cost cents.
  • Cloud NAT, if you chose that networking mode: a standing per-region monthly charge plus data processing, for as long as it’s provisioned; this is a standing cost, not a per-scan one. Google sets these rates: see Google’s Cloud NAT pricing for current pricing.
Every resource workload scanning creates is labeled with the owning tenant, integration, and execution, so you can filter for it directly in your own GCP billing reports.

​
Turning workload scanning off

Turning off Cloud Workload Protection Platform (CWPP), or just workload scanning, from the edit dialog stops Plerion from triggering new scans immediately, and runs one final cleanup pass to delete anything mid-flight. It does not delete the scanning project itself: the project, its network, and any Cloud NAT you enabled stay in your organization and keep accruing their standing costs until you delete them. Plerion’s UI states this plainly next to the toggle.

​
Removing workload scanning entirely

To delete the scanning project and everything in it:
Re-run the onboarding script with --remove-workload-scanning. This deletes the scanning project in one step, including its network, Cloud NAT (if any), service account, and role bindings, and revokes the workload scanning permissions on request.
Deleting the GCP organization integration entirely removes workload scanning access the same way deleting any integration does, including the scanning project, if you haven’t already removed it.

​
Next step