GCP Terraform Misconfiguration: Compute Engine Missing Confidential Computing Features

A Terraform configuration does not enable a Confidential VM.

By default, a Compute Engine instance is not a Confidential VM. A Confidential VM uses hardware-based cryptography for data-in-use protection and to support remote attestations. Non-exportable dedicated per-VM instance keys keep VM memory encrypted, thereby protecting VM confidentiality and integrity against cloud provider access via the higher-privileged hypervisor.

Example 1: The following example shows a Terraform configuration that disables Confidential VM by setting enable_confidential_compute to false.

resource "google_compute_instance" "default" {
  ...
  confidential_instance_config {
    enable_confidential_compute = false
  }
  ...
}