Project: KICS (Provisioning / Security & Compliance)
File: 18d3a83d-4414-49dc-90ea-f0387b2856cc.md

title: Shielded VM Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 18d3a83d-4414-49dc-90ea-f0387b2856cc Query name: Shielded VM Disabled Platform: Ansible Severity: <span style="color:#ff7213">Medium</span> Category: Insecure Configurations URL: Compute instances must be launched with Shielded VM enabled, which means the attribute 'shieldedinstanceconfig' must be defined and its sub attributes 'enablesecureboot', 'enablevtpm' and 'enableintegrity_monitoring' must be set to true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="65 162 3 137 42 112 88" name: create a instance1 google.cloud.gcpcomputeinstance: name: test_object1 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present name: create a instance2 google.cloud.gcpcomputeinstance: name: test_object2 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present shieldedinstanceconfig: enablesecureboot: yes enable_vtpm: yes name: create a instance3 google.cloud.gcpcomputeinstance: name: test_object3 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present shieldedinstanceconfig: enableintegritymonitoring: yes enable_vtpm: yes name: create a instance4 google.cloud.gcpcomputeinstance: name: test_object4 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present shieldedinstanceconfig: enableintegritymonitoring: yes enablesecureboot: yes name: create a instance5 google.cloud.gcpcomputeinstance: name: test_object5 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present shieldedinstanceconfig: enableintegritymonitoring: no enablesecureboot: yes enable_vtpm: yes name: create a instance6 google.cloud.gcpcomputeinstance: name: test_object6 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present shieldedinstanceconfig: enableintegritymonitoring: yes enablesecureboot: no enable_vtpm: yes name: create a instance7 google.cloud.gcpcomputeinstance: name: test_object7 machine_type: n1-standard-1 metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: "{{ network }}" access_configs: name: External NAT nat_ip: "{{ address }}" type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: "/tmp/auth.pem" state: present shieldedinstanceconfig: enableintegritymonitoring: yes enablesecureboot: yes enable_vtpm: no ``` ```yaml title="Negative test num. 1 - yaml file" name: create a instance google.cloud.gcpcomputeinstance: name: test_object machine_type: n1-standard-1 disks: auto_delete: 'true' boot: 'true' source: '{{ disk }}' auto_delete: 'true' interface: NVME type: SCRATCH initialize_params: disk_type: local-ssd metadata: startup-script-url: gs:://graphite-playground/bootstrap.sh cost-center: '12345' labels: environment: production network_interfaces: network: '{{ network }}' access_configs: name: External NAT nat_ip: '{{ address }}' type: ONETOONE_NAT zone: us-central1-a project: test_project auth_kind: serviceaccount serviceaccountfile: /tmp/auth.pem state: present shieldedinstanceconfig: enableintegritymonitoring: yes enablesecureboot: yes enable_vtpm: yes ```