cis-gcp-foundations-4-11

name	cis-gcp-foundations-4.11
description	Ensure That Compute Instances Have Confidential Computing Enabled
category	cis-gcp-foundations
version	4.0.0
author	cyberstrike-official
tags	["cis","gcp","compute","virtual-machines","confidential-computing"]
cis_id	4.11
cis_benchmark	CIS Google Cloud Platform Foundation Benchmark v4.0.0
tech_stack	["gcp"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.11 Ensure That Compute Instances Have Confidential Computing Enabled (Automated)

Profile Applicability

• Level 2

Description

Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing. Confidential Computing is a breakthrough technology that encrypts data in-use while it is being processed. Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU).

Confidential VMs leverage hardware-based memory encryption technologies, such as AMD Secure Encrypted Virtualization (SEV), AMD SEV-SNP, and Intel Trust Domain Extensions (TDX), depending on the chosen machine type and CPU platform. Customer data will stay encrypted while it is used, indexed, queried, or trained on. Encryption keys are generated by and reside solely in dedicated hardware and are not exportable, enhancing isolation and security. Built-in hardware optimizations ensure Confidential Computing workloads experience minimal to no significant performance penalties.

Rationale

Confidential Computing enables customers' sensitive code and other data encrypted in memory during processing. Google does not have access to the encryption keys. Confidential VM can help alleviate concerns about risk related to either dependency on Google infrastructure or Google insiders' access to customer data in the clear.

Impact

• Confidential Computing for Compute instances does not support live migration. Unlike regular Compute instances, Confidential VMs experience disruptions during maintenance events like a software or hardware update.
• Additional charges may be incurred when enabling this security feature. See https://cloud.google.com/compute/confidential-vm/pricing for more info.

Audit

Note: Confidential Computing is currently only supported on limited VM configurations. To learn more about VM configurations supported by Confidential Computing, visit https://cloud.google.com/confidential-computing/confidential-vm/docs/supported-configurations.

From Google Cloud Console

1. Go to the VM instances page by visiting: https://console.cloud.google.com/compute/instances.
2. Click on the instance name to see its VM instance details page.
3. Ensure that Confidential VM service is Enabled.

From Google Cloud CLI

1. List the instances in your project and get details on each instance: