GCP Terraform Misconfiguration: Compute Engine Shielded VM Option Disabled

A Terraform configuration sets up a Compute Engine instance without enabling all recommended Shield VM options.

Every cloud service security feature has a unique ability to prevent or mitigate a known threat. Any feature disabled by intent or mistake offers no protection.

Disabling any Shield VM option allows an attacker to bypass implemented security restrictions for a guest operating system on a Compute Engine instance. Recommended Shield VM options (and their corresponding Terraform configuration identifiers) are as follows:

- Integrity Monitoring (enable_integrity_monitoring)
- Secure Boot (enable_secure_boot)
- Virtual Trusted Platform Module (enable_vtpm)

Example 1: The following Terraform configuration sets enable_integrity_monitoring to false in the shielded_instance_config block. Not all recommended Shield VM options are enabled.

resource "google_compute_instance" "compute_instance_demo" {
  ...
  shielded_instance_config {
    enable_integrity_monitoring = false
    enable_secure_boot = true
    enable_vtpm = true
  }
  ...
}