Control: GCP > CIS v4.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled

Configures auditing against a CIS Benchmark item.

Level: 2

Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology which encrypts data in-use—while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU).

Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYCTM CPUs. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated in hardware, per VM, and not exportable. Thanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.

Resource Types

This control targets the following resource types:

GCP > Compute Engine > Instance

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-cisv4-0#/control/types/r0411

Category URI

tmod:@turbot/cis#/control/categories/v071408

GraphQL

query controlType(id: "tmod:@turbot/gcp-cisv4-0#/control/types/r0411") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-cisv4-0#/control/types/r0411'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-cisv4-0#/control/types/r0411"