Check Details

• Resource: Compute Engine VM Instance
• Check: Enable Shielded VM
• Risk: VM instances without Shielded VM are vulnerable to boot-level and kernel-level malware, rootkits, and unauthorized modifications during the boot process.

Remediation via Google Cloud Console

1. Go to the VM instances page: https://console.cloud.google.com/compute/instances
2. Click on the affected VM instance name to open its details page.
3. Click STOP to stop the instance.
4. Once the instance is stopped, click EDIT.
5. Scroll to the Shielded VM section and enable:
   • Turn on vTPM
   • Turn on Integrity Monitoring
   
6. (Optional) If the instance does not use any custom or unsigned drivers, also enable Turn on Secure Boot.
7. Click Save, then click START to restart the instance.

Remediation via Google Cloud CLI

1. Open the Google Cloud Console and click the Cloud Shell icon (>_) in the top-right corner.
2. Ensure the instance uses an image that supports Shielded VM. To list Shielded VM supported public images, run:

   
   gcloud compute images list \
    --project gce-uefi-images \
    --no-standard-images
   

3. Stop the VM instance:

   
   gcloud compute instances stop <INSTANCE_NAME>
   

4. Enable Shielded VM options:

   
   gcloud compute instances update <INSTANCE_NAME> \
    --shielded-vtpm \
    --shielded-vm-integrity-monitoring
   

5. (Optional) Enable Secure Boot if compatible:

   
   gcloud compute instances update <INSTANCE_NAME> \
    --shielded-vm-secure-boot
   

6. Restart the instance:

   
   gcloud compute instances start <INSTANCE_NAME>
   

Replace <INSTANCE_NAME> with the name of your Compute Engine VM.

Default Value

By default, Google Compute Engine VM instances do not have Shielded VM enabled.