feat(UP-2441): enable recommended ShieldedVM settings on instance templates

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ on:
 env:
   TERRAFORM_VERSION: 1.11.0
   TFLINT_VERSION: v0.48.0
-  TRIVY_VERSION: v0.63.0
+  TRIVY_VERSION: v0.71.2
 
 permissions:
   contents: read         # Required for checkout and reading repository content

modules/main/main.tf

@@ -204,6 +204,16 @@ ENVEOF
     boot         = true
   }
 
+  # Shielded VM settings. Required to satisfy the
+  # constraints/compute.requireShieldedVm org policy (and stricter
+  # policies that mandate Secure Boot). The boot image must be
+  # UEFI_COMPATIBLE, which the default Ubuntu LTS image is.
+  shielded_instance_config {
+    enable_secure_boot          = var.enable_secure_boot
+    enable_vtpm                 = true
+    enable_integrity_monitoring = true
+  }
+
   network_interface {
     network    = local.network
     subnetwork = local.subnet
@@ -430,6 +440,16 @@ ENVEOF
     boot         = true
   }
 
+  # Shielded VM settings. Required to satisfy the
+  # constraints/compute.requireShieldedVm org policy (and stricter
+  # policies that mandate Secure Boot). The boot image must be
+  # UEFI_COMPATIBLE, which the default Ubuntu LTS image is.
+  shielded_instance_config {
+    enable_secure_boot          = var.enable_secure_boot
+    enable_vtpm                 = true
+    enable_integrity_monitoring = true
+  }
+
   network_interface {
     network    = local.network
     subnetwork = local.subnet

modules/main/variables.tf

@@ -173,6 +173,12 @@ variable "boot_image" {
   default     = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"
 }
 
+variable "enable_secure_boot" {
+  type        = bool
+  description = "Enable Secure Boot on scanner instances. Requires a UEFI_COMPATIBLE, signed boot image (the default Ubuntu LTS image qualifies). vTPM and integrity monitoring are always enabled."
+  default     = true
+}
+
 variable "boot_disk_size_gb" {
   type        = number
   description = "The disk size in GB to use."