Google Cloud Compliance ControlsGoogle Kubernetes Engine
GKE clusters should have shielded nodes enabled
GKE cluster nodes must be launched with Shielded VM enabled. The attribute `enable_shielded_nodes` must be set to `true`. Shielded GKE Nodes provide strong, verifiable node identity and integrity.
What this control checks
GKE clusters must set enable_shielded_nodes to true; false fails.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.IR-02
- PR.IR-03
- PR.PS-01
- PR.PS-03
- PR.PS-05
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_shielded_nodes_enabled - Checkov Check:
CKV_GCP_71 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_shielded_nodes_enabled - KICS Query:
579a0727-9c29-4d58-8195-fc5802a8bdb4 - Trivy Check:
GCP-0055
Last reviewed: 2026-10-09