Skip to main content

🛡️ Google GCE Instance is launched without Shielded VM enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.

Rationale​

Shielded VMs are virtual machines (VMs) on Google Cloud Platform hardened by a set of security controls that help defend against rootkits and bootkits.

Shielded VM offers verifiable integrity of your Compute Engine VM instances, so you can be confident your instances haven't been compromised by boot- or kernel-level malware or rootkits. Shielded VM's verifiable integrity is achieved through the use of Secure Boot, virtual trusted platform module (vTPM)-enabled Measured Boot, and integrity monitoring.

Shielded VM instances run firmware which is signed and verified using Google's Certificate Authority, ensuring that the instance's firmware is unmodified and establishing the root of trust for Secure Boot.

Integrity monitoring helps you understand and make decisions about the state of your VM instances and the Shielded VM vTPM enables Measured Boot by performing the measurements needed to create a known good boot baseline, called the integrity policy baseline. The integrity policy baseline is used for comparison with measurements from subsequent VM boots to determine if anything has changed.

... see more

Remediation​

Open File

Remediation​

To be able turn on Shielded VM on an instance, your instance must use an image with Shielded VM support.

From Google Cloud Console​

  1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.
  2. Click on the instance name to see its VM instance details page.
  3. Click STOP to stop the instance.
  4. When the instance has stopped, click EDIT.
  5. In the Shielded VM section, select Turn on vTPM and Turn on Integrity Monitoring.
  6. Optionally, if you do not use any custom or unsigned drivers on the instance, also select Turn on Secure Boot.
  7. Click the Save button to modify the instance and then click START to restart it.

From Google Cloud CLI​

You can only enable Shielded VM options on instances that have Shielded VM support. For a list of Shielded VM public images, run the gcloud compute images list command with the following flags:

        gcloud compute images list --project gce-uefi-images --no-standard-images

  1. Stop the instance:

         gcloud compute instances stop <INSTANCE_NAME>

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 CIS GCP v1.2.0 → 💼 4.8 Ensure Compute instances are launched with Shielded VM enabled - Level 2 (Automated)1no data
💼 CIS GCP v1.3.0 → 💼 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled - Level 2 (Automated)1no data
💼 CIS GCP v2.0.0 → 💼 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled - Level 2 (Automated)1no data
💼 CIS GCP v3.0.0 → 💼 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled - Level 2 (Automated)1no data
💼 Cloudaware Framework → 💼 Threat Protection31no data