# 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233022-4-8-ensure-compute-instances-are-launched-with-shielded-vm-enabled-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: Level 2 Description: Shielded VM is a hardened virtual machine configuration on Google Cloud that defends against rootkits and bootkits. It ensures the integrity of the bootloader, firmware, and operating system through Secure Boot, vTPM (virtual Trusted Platform Module)-enabled Measured Boot, and integrity monitoring. These features protect Compute Engine instances against tampering and provide verifiable instance integrity. Rationale: Enabling Shielded VM ensures that: 1. The boot process only runs authentic software. 2. The system’s firmware and bootloader are verified using Google's Certificate Authority. 3. An integrity baseline is established and monitored to detect any unauthorized changes. This reduces the risk of root-level malware and boot-level exploits, ensuring the security of the instance against advanced threats. Impact: Instances must use images that support Shielded VM. Instances with custom or unsigned drivers may encounter boot issues if Secure Boot is enabled. Users should verify compatibility before enabling Secure Boot. Default Value: Compute instances are not configured with a Shielded VM by default. Audit Steps: #### Using Google Cloud Console: 1. Navigate to Compute Engine > VM Instances: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                        ![](https://support.icompaas.com/assets/kb/8f3e90f45482ed1e.png) 2. Select the instance name to open its details page. ![](https://support.icompaas.com/assets/kb/db6fda2b0e07a394.png) 3. Verify the Shielded VM section to ensure that: - vTPM is enabled. ![](https://support.icompaas.com/assets/kb/e64c7afb563e66ce.png) - Integrity Monitoring is enabled.                          ![](https://support.icompaas.com/assets/kb/ba38aa22070f7506.png) #### Using Google Cloud CLI: List instances and check their Shielded VM settings: gcloud compute instances list --format=json | jq -r '. | "vTPM: \\(.\[\].shieldedInstanceConfig.enableVtpm) IntegrityMonitoring: \\(.\[\].shieldedInstanceConfig.enableIntegrityMonitoring) Name: \\(.\[\].name)"' 1. Confirm the shieldedInstanceConfig section includes enableIntegrityMonitoring and enableVtpm set to true. Remediation Steps: #### Using Google Cloud Console: 1. Navigate to Compute Engine > VM Instances: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).                       ![](https://support.icompaas.com/assets/kb/90b181c2fa11973f.png) 2. Select the instance name and click STOP to halt the instance ![](https://support.icompaas.com/assets/kb/ff9809bd0ec48692.png) 3. Click EDIT and under the Shielded VM section:                             ![](https://support.icompaas.com/assets/kb/c737190303e45afa.png) - Enable Turn on vTPM. ![](https://support.icompaas.com/assets/kb/296b78add64e0272.png) - Enable Turn on Integrity Monitoring. ![](https://support.icompaas.com/assets/kb/d0c79f9b94629cde.png) - Optionally, enable Turn on Secure Boot if no custom or unsigned drivers are used.     ![](https://support.icompaas.com/assets/kb/9230a7bd212fbfe9.png) 4. Save the changes and restart the instance.           ![](https://support.icompaas.com/assets/kb/a9741ac532b7d855.png) Using Google Cloud CLI: Stop the instance: gcloud compute instances stop Update the instance to enable Shielded VM option: gcloud compute instances update --shielded-vtpm --shielded-vm-integrity-monitoring Optionally, enable Secure Boot: gcloud compute instances update --shielded-vm-secure-boot Restart the instance: gcloud compute instances start Prevention: To enforce Shielded VM for all new instances, configure an Organization Policy: - Set up Shielded VM Policy. References: 1. [Modifying Shielded VM Instances](https://cloud.google.com/compute/docs/instances/modifying-shielded-vm) 2. [Google Cloud Shielded VM Overview](https://cloud.google.com/shielded-vm) 3. [Shielded VM Policy Configuration](https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint) Additional Information: - Enabling Secure Boot may cause boot failures if custom or unsigned drivers are installed. Verify driver compatibility beforehand. Shielded VM functionality requires an image with Shielded VM support. To list such images: gcloud compute images list --project gce-uefi-images --no-standard-images CIS Controls:

Control

Description

IG 1

IG 2

IG 3

5.2 Maintain Secure Images

Maintain secure and approved images or templates for system deployment. Any compromised system should be re-imaged.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.