Google Cloud Compliance ControlsGoogle Cloud Compute Engine
Compute Engine instances should have Shielded VM enabled at launch
Compute Engine VM instances should have vTPM and Integrity Monitoring enabled as part of Shielded VM configuration. Checkov CKV_GCP_39 checks that Compute instances are launched with Shielded VM enabled.
What this control checks
Compute instances launched with Shielded VM, with vTPM and Integrity Monitoring enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 6 Security in network and information systems acquisition, development and maintenance
NIST Cybersecurity Framework v2.0
- ID.AM-01: Inventories of hardware managed by the organization are maintained.
- ID.RA-09
- PR.IR-02
- PR.IR-03
- 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled
- 4.8 Ensure Compute Instances Are Launched With Shielded VM Enabled
- 4.8 Ensure Compute instances are launched with Shielded VM enabled
- 4.8 Ensure Compute instances are launched with Shielded VM enabled
- 4.8 Ensure Compute instances are launched with Shielded VM enabled
Related controls
- GKE cluster shielded nodes should have integrity monitoring enabled
- Compute Engine instances should have attached disk auto-delete disabled
- Compute Engine instances should have high-level basic roles restricted
- Compute Engine instances should have write permissions on deny policies restricted
- Compute Engine instances should have data destruction permissions restricted
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_instance_shielded_vm_enabled - Checkov Check:
CKV_GCP_39 - Powerpipe Control:
gcp_compliance.control.compute_instance_shielded_vm_enabled - Prowler Check:
compute_instance_shielded_vm_enabled
Last reviewed: 2026-10-09