Check Details

• Resource: Compute Engine VM Instance
• Check: Enable Confidential Computing
• Risk: Without Confidential Computing, sensitive data in memory may be exposed to potential unauthorized access or advanced attack vectors.

Remediation via Google Cloud Console

Confidential Computing can only be enabled during VM creation. Existing instances must be deleted and recreated.

1. Log in to the Google Cloud Console and open the VM instances page.
2. Click Create Instance.
3. Configure the required VM settings such as name, region, zone, and machine type.
4. Under the Security section, enable Confidential Computing.
5. Click Create to launch the VM instance.

Remediation via Google Cloud CLI

Create a new Compute Engine VM instance with Confidential Computing enabled.

1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner.
2. Run the following command:

   
   gcloud compute instances create <INSTANCE_NAME> \
    --zone <ZONE> \
    --confidential-compute \
    --maintenance-policy=TERMINATE
   

Replace <INSTANCE_NAME> and <ZONE> with the appropriate values.

Default Value

By default, Confidential Computing is disabled for Compute Engine VM instances.