cis_extensions.shielded_vm — version 1.3

Source: presets/cis/shielded-vm.satz

Purpose

CIS 4.8 — Shielded VM.

Opt-in because not every image supports Shielded VM; an org with custom or older images will fail instance creation until those images are rebuilt. This is also the one constraint here with NO managed form and no dry-run support, so it cannot be tested in dry-run mode before it is enforced.

The constraint name and its shape were verified against a live organisation's OrgPolicy ListConstraints, not transcribed.

Use it

params {
  cis_require_shielded_vm = true
}

use "presets/cis/shielded-vm.satz" when cis_require_shielded_vm

cis_require_shielded_vm is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by CIS_GCP_Foundation_4_0, and the estate's own binding wins.

Needs from outside the pack:

Params

None — the pack takes everything from the estate's params.

Notices

What to run once this pack is switched on. satz shows each notice when the pack goes on and until the estate binds its param true; every command that writes to the organisation refuses while one whose severity is error is open.

param run severity what and why
cis_require_shielded_vm_adopted satz adopt <estate> --execute --import error Google may already hold a policy this pack declares on the organisation, set by an administrator or by default, and an apply that creates a policy that exists stops on 409 POLICY_ALREADY_EXISTS. Run satz adopt once the pack is on, so every live policy is in the state before the apply; with --import it binds this param itself when it has run.

Contributes

resource type labels
google_org_policy_policy compute-requireShieldedVm

Claims

framework control title kind witnesses interpretation
cis-gcp 4.0 4.8 Compute instances launched with Shielded VM enabled implements google_org_policy_policy.compute_requireShieldedVm Instances must boot as Shielded VMs: secure boot, vTPM and integrity monitoring.
cis-gcp 5.0 4.8 Compute instances launched with Shielded VM enabled implements google_org_policy_policy.compute_requireShieldedVm As for 4.0 §4.8 (5.0 §4.8, unchanged).

What the controls ask (this project's paraphrase from the catalog — never the framework's own text):

Every resource this pack contributes is a witness of a claim above.

History

version date change
1.3 2026-09-30 every claim states its measure without satz: gcloud (the commands that meet the control the way the claim's resources do), gcloud_check (the commands that show whether it is met) and risk (what goes wrong without it); require and report-compliance carry them in each control's measures. Nothing emitted changes
1.2 2026-09-20 the notice's before = apply becomes severity = error: the same refusal, stated once by the pack instead of inside the two commands that read it — every command that writes to the organisation refuses while it is open. Nothing emitted changes, and the param that acknowledges it is unchanged
1.1 2026-09-19 a notice: once the pack is switched on, satz adopt <estate> --execute --import is to run before the apply, because a policy it declares may already be live and creating it stops on 409 POLICY_ALREADY_EXISTS. The estate acknowledges it with cis_require_shielded_vm_adopted = true, which adopt --execute --import binds itself when it has run; transpile --apply and bootstrap refuse while it is open. The param is never emitted, so the plan does not move
1.0 2026-09-04 CIS 4.8, opt-in: image support required, and the only constraint here with no managed form and no dry-run

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

The one constraint in this set with no managed form and no dry-run support: it cannot be rehearsed before it is enforced. Check that every image in use supports Shielded VM first — an older or custom image fails instance creation from the moment it is on.