Back to Checks
gcp

Compute instance has vTPM and Integrity Monitoring enabled

compute_instance_shielded_vm_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:node-security
Resource Type:compute.googleapis.com/Instance

Compute Engine VM instances have vTPM and Integrity Monitoring enabled as part of Shielded VM configuration.

Prowler logoProwlerprowler-provider-gcp

Risk

Without vTPM or Integrity Monitoring, boot integrity isn't verified. Attackers can persist bootkits/rootkits, alter firmware, and evade attestation, enabling covert control and data theft.

  • Integrity: compromised boot chain
  • Confidentiality: secrets bound to TPM exposed
  • Availability: malicious boot code can brick VMs

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_instance_shielded_vm_enabled

Recommendation

Enable Shielded VM with vTPM and Integrity Monitoring set to enabled on all VMs. Prefer Secure Boot where compatible. Enforce via hardened images/templates, apply least privilege to shielded settings, and monitor integrity results-supporting defense in depth and trusted boot.

Remediation

Terraform

resource "google_compute_instance" "<example_resource_name>" {
  name         = "<example_resource_name>"
  machine_type = "e2-micro"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }

  network_interface {
    network = "default"
  }

  shielded_instance_config {
    enable_vtpm                 = true  # Critical: enable vTPM
    enable_integrity_monitoring = true  # Critical: enable Integrity Monitoring
  }
}

Other

1In Google Cloud Console, go to Compute Engine > VM instances
2Click the VM name
3Click Stop and wait for the VM to stop
4Click Edit
5In Shielded VM, enable vTPM and enable Integrity monitoring
6Click Save
7Click Start to start the VM

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_instance_shielded_vm_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for instance in compute_client.instances:
            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
            report.status = "PASS"
            report.status_extended = f"VM Instance {instance.name} has vTPM or Integrity Monitoring set to on."
            if (
                not instance.shielded_enabled_vtpm
                or not instance.shielded_enabled_integrity_monitoring
            ):
                report.status = "FAIL"
                report.status_extended = f"VM Instance {instance.name} doesn't have vTPM and Integrity Monitoring set to on."
            findings.append(report)

        return findings

References