Control: GCP > Compute Engine > Instance > Shielded Instance Configuration

Check whether the Shielded VM settings of a GCP Compute Engine instance (Secure Boot, vTPM and Integrity Monitoring) match the Shielded Instance Configuration > * policies, and optionally enforce them.

GCP only accepts Shielded VM configuration changes while the instance is stopped, and the new settings take effect on the next boot. With Enforce: Enabled per ... the control applies the configuration once the instance is stopped; while the instance is running or still stopping it stays in alarm without attempting the update, since GCP would reject it.

Resource Types

This control targets the following resource types:

GCP > Compute Engine > Instance

Policies

The following policies can be used to configure this control:

GCP > Compute Engine > Instance > Shielded Instance Configuration

This control type relies on these other policies when running actions:

Permissions

Cloud permissions used by this control and its actions:

compute.instances.updateShieldedInstanceConfig

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-computeengine#/control/types/shieldedInstanceConfiguration

Category URI

tmod:@turbot/turbot#/control/categories/security

GraphQL

query controlType(id: "tmod:@turbot/gcp-computeengine#/control/types/shieldedInstanceConfiguration") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-computeengine#/control/types/shieldedInstanceConfiguration'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-computeengine#/control/types/shieldedInstanceConfiguration"