feat(UP-2441): enable recommended ShieldedVM settings on instance templates

[snaebjor]

Problem

HarborFreight had no scanners spinning up: the MIG could not create instances because both instance templates (UP-2441) lacked a shielded_instance_config block, failing an org policy requiring Shielded VM with Secure Boot (constraints/compute.requireShieldedVm).

Change

Added shielded_instance_config to both the cloudscanner and DSPM instance templates, with all three Shielded VM settings enabled explicitly:

shielded_instance_config {
  enable_secure_boot          = var.enable_secure_boot   # default true
  enable_vtpm                 = true
  enable_integrity_monitoring = true
}

• vTPM and integrity monitoring are set explicitly (on) rather than relying on provider defaults, to fully satisfy policies that require a complete Shielded VM configuration.
• Secure Boot is gated behind a new enable_secure_boot variable (default true) so a customer on a non-UEFI custom boot_image can opt out.

Validation

• Constraint: Secure Boot requires a UEFI_COMPATIBLE, signed boot image.
• Current source image is fine: default ubuntu-os-cloud/ubuntu-2404-lts-amd64 (live: ubuntu-2404-noble-amd64-v20260615) carries the UEFI_COMPATIBLE guest OS feature and Ubuntu LTS images are signed for Secure Boot. No image change needed.
• Secure Boot blocks unsigned kernel modules; the scanner startup loads none, so no impact.
• terraform fmt -check and terraform validate pass.

Also: CI fix (trivy)

The pinned TRIVY_VERSION v0.63.0 was removed upstream (404 from the trivy releases), so the Security Scan job failed on every run. Bumped to v0.71.2 (current latest).

Rollout note

Applying replaces the instance templates and recreates the MIGs (create_before_destroy / replace_triggered_by), so scanner VMs will cycle on rollout — expected.

🤖 Generated with Claude Code

[ahumph]

According to Google's docs, requireShieldedVm needs the other two, so I would maybe be explicit here to be safe?

shielded_instance_config {
  enable_secure_boot          = true
  enable_vtpm                 = true
  enable_integrity_monitoring = true
}

[snaebjor]

That's what our friend Claude suggested to begin with - that's sorted now