Check ID: compute_instance_shielded_vm_enabled
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: node-security
Resource type: compute.googleapis.com/Instance

​
What this check verifies

Compute Engine VM instances have vTPM and Integrity Monitoring enabled as part of Shielded VM configuration.

​
Risk

Without vTPM or Integrity Monitoring, boot integrity isn’t verified. Attackers can persist bootkits/rootkits, alter firmware, and evade attestation, enabling covert control and data theft.
  • Integrity: compromised boot chain
  • Confidentiality: secrets bound to TPM exposed
  • Availability: malicious boot code can brick VMs

​
Recommendation

Enable Shielded VM with vTPM and Integrity Monitoring set to enabled on all VMs. Prefer Secure Boot where compatible. Enforce via hardened images/templates, apply least privilege to shielded settings, and monitor integrity results-supporting defense in depth and trusted boot.

​
Remediation

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = "default"
  }

  shielded_instance_config {
    enable_vtpm                 = true  # Critical: enable vTPM
    enable_integrity_monitoring = true  # Critical: enable Integrity Monitoring
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_shielded_vm_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks