Control: 4.8 Ensure Compute instances are launched with Shielded VM enabled
Description
To defend against against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.
Shielded VMs are virtual machines (VMs) on Google Cloud Platform hardened by a set of security controls that help defend against rootkits and bootkits.
Integrity monitoring helps you understand and make decisions about the state of your VM instances and the Shielded VM vTPM enables Measured Boot by performing the measurements needed to create a known good boot baseline, called the integrity policy baseline. The integrity policy baseline is used for comparison with measurements from subsequent VM boots to determine if anything has changed.
Remediation
To be able turn on Shielded VM on an instance, your instance must use an image with Shielded VM support.
From Console
- Login to VM instances.
- Click on the instance name to see its VM instance details page.
- Click STOP to stop the instance.
- When the instance has stopped, click EDIT.
- In the
Shielded VMsection, select Turn onvTPMand Turn onIntegrity Monitoring. - Optionally, if you do not use any custom or unsigned drivers on the instance, also select Turn on Secure Boot.
- Click the Save button to modify the instance and then click START to restart it.
From Command Line
You can only enable Shielded VM options on instances that have Shielded VM support. For a list of Shielded VM public images, run the gcloud compute images list command with the following flags:
- Stop the instance:
gcloud compute instances stop INSTANCE_NAME
- Update the instance:
gcloud compute instances update INSTANCE_NAME --shielded-vtpm --shielded-vmintegrity-monitoring
- Optionally, if you do not use any custom or unsigned drivers on the instance, also turn on secure boot.
gcloud compute instances update INSTANCE_NAME --shielded-vm-secure-boot
- Restart the instance:
gcloud compute instances start INSTANCE_NAME
Usage
Run the control in your terminal:
powerpipe control run gcp_compliance.control.cis_v120_4_8Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run gcp_compliance.control.cis_v120_4_8 --shareSQL
This control uses a named query:
compute_instance_shielded_vm_enabled