From 6cef1626740546f9b8a236c61eb0364506da6b32 Mon Sep 17 00:00:00 2001 From: Snaebjorn Eyjolfsson Date: Fri, 19 Jun 2026 15:07:09 +0000 Subject: [PATCH 1/4] feat(UP-2441): enable recommended ShieldedVM settings on instance templates Both the cloudscanner and DSPM instance templates lacked a shielded_instance_config block, so instances failed to create under org policies requiring Shielded VM with Secure Boot (e.g. HarborFreight), leaving the MIG with no running scanners. Add shielded_instance_config to both templates with vTPM and integrity monitoring always on, and Secure Boot gated behind a new enable_secure_boot variable (default true). The default Ubuntu LTS boot image is UEFI_COMPATIBLE and signed, so Secure Boot works out of the box. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/main/main.tf | 20 ++++++++++++++++++++ modules/main/variables.tf | 6 ++++++ 2 files changed, 26 insertions(+) diff --git a/modules/main/main.tf b/modules/main/main.tf index e9c7928..1d60986 100644 --- a/modules/main/main.tf +++ b/modules/main/main.tf @@ -204,6 +204,16 @@ ENVEOF boot = true } + # Shielded VM settings. Required to satisfy the + # constraints/compute.requireShieldedVm org policy (and stricter + # policies that mandate Secure Boot). The boot image must be + # UEFI_COMPATIBLE, which the default Ubuntu LTS image is. + shielded_instance_config { + enable_secure_boot = var.enable_secure_boot + enable_vtpm = true + enable_integrity_monitoring = true + } + network_interface { network = local.network subnetwork = local.subnet @@ -430,6 +440,16 @@ ENVEOF boot = true } + # Shielded VM settings. Required to satisfy the + # constraints/compute.requireShieldedVm org policy (and stricter + # policies that mandate Secure Boot). The boot image must be + # UEFI_COMPATIBLE, which the default Ubuntu LTS image is. + shielded_instance_config { + enable_secure_boot = var.enable_secure_boot + enable_vtpm = true + enable_integrity_monitoring = true + } + network_interface { network = local.network subnetwork = local.subnet diff --git a/modules/main/variables.tf b/modules/main/variables.tf index 3ecb1d5..664ae98 100644 --- a/modules/main/variables.tf +++ b/modules/main/variables.tf @@ -173,6 +173,12 @@ variable "boot_image" { default = "ubuntu-os-cloud/ubuntu-2404-lts-amd64" } +variable "enable_secure_boot" { + type = bool + description = "Enable Secure Boot on scanner instances. Requires a UEFI_COMPATIBLE, signed boot image (the default Ubuntu LTS image qualifies). vTPM and integrity monitoring are always enabled." + default = true +} + variable "boot_disk_size_gb" { type = number description = "The disk size in GB to use." From c1594f49726575b4a869a5e19d24553e26466147 Mon Sep 17 00:00:00 2001 From: Snaebjorn Eyjolfsson Date: Fri, 19 Jun 2026 15:11:18 +0000 Subject: [PATCH 2/4] refactor(UP-2441): only configure Secure Boot explicitly vTPM and integrity monitoring default to on in the provider and were already enabled for the UEFI_COMPATIBLE Ubuntu image, so drop the redundant explicit lines and configure only Secure Boot. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/main/main.tf | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/modules/main/main.tf b/modules/main/main.tf index 1d60986..3151b91 100644 --- a/modules/main/main.tf +++ b/modules/main/main.tf @@ -204,14 +204,13 @@ ENVEOF boot = true } - # Shielded VM settings. Required to satisfy the - # constraints/compute.requireShieldedVm org policy (and stricter - # policies that mandate Secure Boot). The boot image must be - # UEFI_COMPATIBLE, which the default Ubuntu LTS image is. + # Enable Secure Boot to satisfy org policies that mandate it (e.g. + # constraints/compute.requireShieldedVm with Secure Boot). vTPM and + # integrity monitoring are left at their provider defaults (on), which + # they already were for the UEFI_COMPATIBLE default Ubuntu LTS image. + # Secure Boot requires that UEFI_COMPATIBLE, signed image. shielded_instance_config { - enable_secure_boot = var.enable_secure_boot - enable_vtpm = true - enable_integrity_monitoring = true + enable_secure_boot = var.enable_secure_boot } network_interface { @@ -440,14 +439,13 @@ ENVEOF boot = true } - # Shielded VM settings. Required to satisfy the - # constraints/compute.requireShieldedVm org policy (and stricter - # policies that mandate Secure Boot). The boot image must be - # UEFI_COMPATIBLE, which the default Ubuntu LTS image is. + # Enable Secure Boot to satisfy org policies that mandate it (e.g. + # constraints/compute.requireShieldedVm with Secure Boot). vTPM and + # integrity monitoring are left at their provider defaults (on), which + # they already were for the UEFI_COMPATIBLE default Ubuntu LTS image. + # Secure Boot requires that UEFI_COMPATIBLE, signed image. shielded_instance_config { - enable_secure_boot = var.enable_secure_boot - enable_vtpm = true - enable_integrity_monitoring = true + enable_secure_boot = var.enable_secure_boot } network_interface { From deb83e63411de04307fdb76db4b652e63865bc74 Mon Sep 17 00:00:00 2001 From: Snaebjorn Eyjolfsson Date: Fri, 19 Jun 2026 15:14:13 +0000 Subject: [PATCH 3/4] fix(UP-2441): bump trivy to v0.71.2 (v0.63.0 was pulled) The pinned TRIVY_VERSION v0.63.0 release was removed upstream (404 from the trivy releases), so the Security Scan job could no longer download the binary and failed on every run. Bump to the current latest release. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b173a22..78a5d71 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,7 +18,7 @@ on: env: TERRAFORM_VERSION: 1.11.0 TFLINT_VERSION: v0.48.0 - TRIVY_VERSION: v0.63.0 + TRIVY_VERSION: v0.71.2 permissions: contents: read # Required for checkout and reading repository content From e5a812bc0796c3bd73b0b0491e29822be456e6f6 Mon Sep 17 00:00:00 2001 From: Snaebjorn Eyjolfsson Date: Fri, 19 Jun 2026 16:42:15 +0000 Subject: [PATCH 4/4] feat(UP-2441): explicitly enable vTPM and integrity monitoring Configure all three Shielded VM settings explicitly (Secure Boot, vTPM, integrity monitoring) rather than relying on provider defaults, to fully satisfy org policies requiring a complete Shielded VM configuration. Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/main/main.tf | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/modules/main/main.tf b/modules/main/main.tf index 3151b91..1d60986 100644 --- a/modules/main/main.tf +++ b/modules/main/main.tf @@ -204,13 +204,14 @@ ENVEOF boot = true } - # Enable Secure Boot to satisfy org policies that mandate it (e.g. - # constraints/compute.requireShieldedVm with Secure Boot). vTPM and - # integrity monitoring are left at their provider defaults (on), which - # they already were for the UEFI_COMPATIBLE default Ubuntu LTS image. - # Secure Boot requires that UEFI_COMPATIBLE, signed image. + # Shielded VM settings. Required to satisfy the + # constraints/compute.requireShieldedVm org policy (and stricter + # policies that mandate Secure Boot). The boot image must be + # UEFI_COMPATIBLE, which the default Ubuntu LTS image is. shielded_instance_config { - enable_secure_boot = var.enable_secure_boot + enable_secure_boot = var.enable_secure_boot + enable_vtpm = true + enable_integrity_monitoring = true } network_interface { @@ -439,13 +440,14 @@ ENVEOF boot = true } - # Enable Secure Boot to satisfy org policies that mandate it (e.g. - # constraints/compute.requireShieldedVm with Secure Boot). vTPM and - # integrity monitoring are left at their provider defaults (on), which - # they already were for the UEFI_COMPATIBLE default Ubuntu LTS image. - # Secure Boot requires that UEFI_COMPATIBLE, signed image. + # Shielded VM settings. Required to satisfy the + # constraints/compute.requireShieldedVm org policy (and stricter + # policies that mandate Secure Boot). The boot image must be + # UEFI_COMPATIBLE, which the default Ubuntu LTS image is. shielded_instance_config { - enable_secure_boot = var.enable_secure_boot + enable_secure_boot = var.enable_secure_boot + enable_vtpm = true + enable_integrity_monitoring = true } network_interface {