Guided Lab: Configuring Shielded VM Options

Description

Shielded VMs in Google Cloud provide enhanced security features that help protect against rootkits and boot‑ or kernel-level malware. They use Secure Boot, a virtual Trusted Platform Module (vTPM), and Integrity Monitoring to ensure that your VM’s boot process has not been tampered with.

These features are especially valuable for workloads that require strong security guarantees, such as financial applications, healthcare systems, or regulated environments. By enabling Shielded VM options, you add an extra layer of defense to your Compute Engine instances without changing how you deploy or manage them.

In this guided lab, you will learn how to create a Shielded VM instance in Google Cloud and verify that its security features are active

Prerequisites

To ensure the successful completion of this lab, you must have prior experience in creating VM instances and be familiar with their essential components. If you feel that your knowledge in this area is insufficient, we highly recommend taking this lab to gain the necessary understanding:

• Guided Lab: How to Launch a GCP Compute Engine Linux Instance

Objectives

In this lab, you will:

• Create a Shielded VM instance.
• Verify that Secure Boot, vTPM, and Integrity Monitoring are enabled.
• Test Secure Boot status via system logs.
• Confirm the presence of the vTPM device inside the VM.

Subscribe to access GCP PlayCloud Labs

Lab Steps

Create a Shielded VM Instance

1. In the Cloud Console, navigate to Compute Engine → VM instances.

2. Click Create instance.

3. Enter the desired name.

4. Select a machine type (e.g., e2-small).

5. Expand the Security section:

• Check Enable Secure Boot.
• Check Enable vTPM.
• Check Enable Integrity Monitoring.

6. Leave other configurations at their default values.

7. Click Create.

Verify Shielded VM Options

1. Once the VM is running, click on the instance name.

2. Scroll to the Security section.

3. Confirm that Secure Boot, vTPM, and Integrity Monitoring are shown as On.

Test Secure Boot

1. Connect to the VM via SSH.

2. Run:

sudo journalctl -k | grep -i secure

3. This confirms Secure Boot status in kernel logs.

Test vTPM Device

1. From the SSH session, run:

ls /dev/tpm*

2. You should see a TPM device (e.g., /dev/tpm0).

3. This confirms that the virtual Trusted Platform Module (vTPM) is available to the VM.

4. Applications can use this device for attestation and cryptographic operations.

Congratulations! You have successfully created a Shielded VM instance in Google Cloud. You enabled Secure Boot, vTPM, and Integrity Monitoring, connected via SSH, and verified that these protections are active. This workflow demonstrates how Shielded VMs provide a stronger security posture for sensitive workloads, ensuring that your VM’s boot process is protected against tampering and unauthorized changes.