Control: GCP > CIS v5.0 > 4 - Virtual Machines > 4.11 - Ensure That Compute Instances Have Confidential Computing Enabled

Configures auditing against a CIS Benchmark item.

Level: 2

Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology that encrypts data in-use while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU).

Confidential VMs leverage hardware-based memory encryption technologies, such as AMD Secure Encrypted Virtualization (SEV), AMD SEV-SNP, and Intel Trust Domain Extensions (TDX), depending on the chosen machine type and CPU platform. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated by and reside solely in dedicated hardware and are not exportable, enhancing isolation and security. Built-in hardware optimizations ensure Confidential Computing workloads experience minimal to no significant performance penalties.

Resource Types

This control targets the following resource types:

GCP > Compute Engine > Instance

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-cisv5-0#/control/types/r0411

Category URI

tmod:@turbot/cis#/control/categories/v071408

GraphQL

query controlType(id: "tmod:@turbot/gcp-cisv5-0#/control/types/r0411") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-cisv5-0#/control/types/r0411'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-cisv5-0#/control/types/r0411"