> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Managing GCP workload scanning

> Re-run onboarding to pick up changes, scope scanning to specific regions, and turn workload scanning off or remove it entirely

Workload scanning is managed from the same GCP organization integration's detail page as the rest of the integration. This page covers the ongoing operations: re-running onboarding, scoping which regions are scanned, and turning the capability off or removing it.

***

## Re-running onboarding

The onboarding script and Terraform template are safe to run again at any time. Re-running either one:

* Picks up any new permissions Plerion has added to the workload scanning roles since you last ran it.
* Converges the scanning project's configuration if it was only partially created: the script finds the existing project by its `plerion-scan=true` label and fixes whatever's missing, rather than creating a duplicate.
* Applies a changed billing account, if you pass a different `--billing-account` value.

You don't need to delete anything first. If Plerion's edit dialog shows an **expanded access** warning after you change a capability, re-running the script or Terraform apply is exactly what resolves it.

***

## Workload regions

Use **Limit scanning to specific regions** in the wizard or edit dialog to restrict workload scanning to an allowlist of regions. This is a pure scan-scope filter. It doesn't provision any region-specific infrastructure ahead of time. Leave it empty to scan workloads wherever they're found; scan disks and scanner VMs are always created on demand, in whichever region a scan is currently running in.

Changing this setting takes effect on the next scan cycle, but it doesn't retroactively affect a scan already in progress.

***

## Cost

You pay for scanning compute directly, in the scanning project's own billing; there's no separate Plerion metering or invoice for it. What drives cost:

* **Scanner VM time**: a typical VM scan costs a small amount of compute time. The scan is bounded by a 120-minute hard timeout, so a single scan's cost has a firm ceiling.
* **Snapshot and scan disk storage**: both are short-lived (deleted at the end of the scan) and cost cents.
* **Cloud NAT**, if you chose that networking mode: a standing per-region monthly charge plus data processing, for as long as it's provisioned; this is a standing cost, not a per-scan one. Google sets these rates: see [Google's Cloud NAT pricing](https://cloud.google.com/vpc/network-pricing#nat) for current pricing.

Every resource workload scanning creates is labeled with the owning tenant, integration, and execution, so you can filter for it directly in your own GCP billing reports.

***

## Turning workload scanning off

Turning off Cloud Workload Protection Platform (CWPP), or just workload scanning, from the edit dialog stops Plerion from triggering new scans immediately, and runs one final cleanup pass to delete anything mid-flight. It does **not** delete the scanning project itself: the project, its network, and any Cloud NAT you enabled stay in your organization and keep accruing their standing costs until you delete them. Plerion's UI states this plainly next to the toggle.

***

## Removing workload scanning entirely

To delete the scanning project and everything in it:

<Tabs>
  <Tab title="Script">
    Re-run the onboarding script with `--remove-workload-scanning`. This deletes the scanning project in one step, including its network, Cloud NAT (if any), service account, and role bindings, and revokes the workload scanning permissions on request.
  </Tab>

  <Tab title="Console">
    Delete the scanning project directly:

    ```bash theme={"system"}
    gcloud projects delete plerion-scan-<id>
    ```

    Find the exact project ID on the integration's detail page, or by searching your GCP console for the project labeled `plerion-scan=true`.
  </Tab>
</Tabs>

Deleting the GCP organization integration entirely removes workload scanning access the same way deleting any integration does, including the scanning project, if you haven't already removed it.

***

## Next step

* [FAQ](/guides/integrations/gcp/workload-scanning/faq)