보안 VM의 기능인 보안 부팅과 신중한 부팅을 사용하여 컨피덴셜 VM 인스턴스의 무결성을 모니터링할 수도 있습니다.
보안 부팅
보안 부팅은 모든 부팅 구성요소의 디지털 서명을 확인하고 서명 확인에 실패할 경우 부팅 프로세스를 종료하여 컨피덴셜 VM 인스턴스의 시스템에서 신뢰할 수 있는 소프트웨어만 실행되도록 합니다. Google 인증 기관에서 서명하고 확인한 펌웨어는 보안 부팅에 신뢰할 수 있는 루트를 설정하여 VM의 ID를 확인하고 VM이 지정된 프로젝트와 리전에 속하는지 확인합니다.
보안 부팅은 기본적으로 사용 설정되지 않습니다. 이 기능을 사용 설정하는 방법과 자세한 내용은 보안 부팅을 참고하세요.
신중한 부팅
신중한 부팅은 컨피덴셜 VM 인스턴스의 vTPM (Virtual Trusted Platform Module)에 의해 사용 설정되며 인스턴스의 악의적 수정으로부터 보호합니다.
신중한 부팅은 컨피덴셜 VM 인스턴스의 부트로더, 커널, 부팅 드라이버의 무결성을 모니터링합니다.
컨피덴셜 VM 인스턴스의 신중한 부팅 중에는 SEV가 사용 중임을 인코딩하는 공급업체별 이벤트인 GceNonHostInfo로 PCR[0] (플랫폼 제어 등록)이 확장됩니다.
신중한 부팅은 새 컨피덴셜 VM 인스턴스에서 기본적으로 사용 설정됩니다. 신중한 부팅에 대해 자세히 알아보세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-08(UTC)"],[[["\u003cp\u003eIntegrity monitoring, available for both Shielded and Confidential VMs, utilizes Cloud Monitoring and Cloud Logging to track and report on the state of VM instances.\u003c/p\u003e\n"],["\u003cp\u003eConfidential VMs have integrity monitoring enabled by default, but you can modify settings, including Secure Boot, vTPM, and integrity monitoring itself, through the Shielded VM options.\u003c/p\u003e\n"],["\u003cp\u003eEach boot of an AMD SEV-based Confidential VM generates a launch attestation report event, which can be viewed in Cloud Logging and includes details like integrity check results and SEV policy.\u003c/p\u003e\n"],["\u003cp\u003eSecure Boot and Measured Boot are features of Shielded VM that can be used with Confidential VM instances to ensure software authenticity and monitor for malicious modifications, with Measured Boot being enabled by default in new instances.\u003c/p\u003e\n"],["\u003cp\u003eThe integrity validation events can be viewed and have alerts set on them, you can also learn how to automate responses to integrity failures.\u003c/p\u003e\n"]]],[],null,["# Monitor Confidential VM integrity\n\nIntegrity monitoring is a feature of both\n[Shielded VM](/compute/shielded-vm/docs/shielded-vm) and Confidential VM\nthat helps you to understand and make decisions about the state of your VM\ninstances. It makes use of both [Cloud Monitoring](/monitoring/docs) and\n[Cloud Logging](/logging/docs).\n\nIntegrity monitoring is enabled by default on new Confidential VM instances. To\nlearn how to change integrity monitoring settings---including toggling\nSecure Boot, vTPM, and integrity monitoring itself---see\n[Modifying Shielded VM options](/compute/docs/instances/modifying-shielded-vm).\n\nView integrity reports\n----------------------\n\nYou can use Cloud Monitoring to view integrity validation events and set\nalerts for them, and Cloud Logging to review the details of those events.\n\nTo learn how to view integrity validation events and set alerts on them, see\n[Monitoring VM boot integrity by using Monitoring](/compute/docs/instances/integrity-monitoring#monitoring).\n\nView launch attestation report events\n-------------------------------------\n\nEach time an AMD SEV-based Confidential VM instance boots, a launch attestation\nreport event is generated as part of the integrity validation events for the VM.\n\nThe report event contains the following useful information:\n\n- `integrityEvaluationPassed`: The result of an integrity check performed by\n the Virtual Machine Monitor on the measurement computed by SEV.\n\n- `sevPolicy`: The SEV policy bits set for this VM. Policy bits are set at\n Confidential VM instance launch to enforce constraints, such as whether debug\n mode is enabled.\n\nTo view a launch attestation report event in an integrity report, complete\nthe following steps:\n\n1. In the Google Cloud console, go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n2. In the VM instances table, find your Confidential VM instance and then click\n its name.\n\n3. In the **Logs** section, click **Cloud Logging**.\n\n4. Cloud Logging opens, and the integrity report populates with integrity\n validation events for the given time range. You might need to change the\n time range of the log (next to the **Search all fields** box) to capture the\n boot events.\n\n5. Find a report that has a type of `cloud_integrity.IntegrityEvent` and a\n `bootCounter` of `0`, and then expand it.\n\n To view the data for a specific field, click the\n arrow_right expander arrow. To expand\n all fields, click **Expand nested fields**.\n6. Inside the `jsonPayload` key, look for the `sevLaunchAttestationReportEvent`\n key to view the report event. Expand following widget for an example of a\n typical integrity report.\n\n #### Integrity report example\n\n ```gdscript\n {\n insertId: \"0\"\n jsonPayload: {\n @type: \"type.googleapis.com/cloud_integrity.IntegrityEvent\"\n bootCounter: \"0\"\n sevLaunchAttestationReportEvent: {\n integrityEvaluationPassed: true\n sevPolicy: {\n debugEnabled: false\n domainOnly: false\n esRequired: false\n keySharingAllowed: false\n minApiMajor: 0\n minApiMinor: 0\n sendAllowed: true\n sevOnly: true\n }\n }\n }\n logName: \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/logs/compute.googleapis.com%2Fshielded_vm_integrity\"\n receiveTimestamp: \"2023-08-06T23:43:09.422303036Z\"\n resource: {\n labels: {\n instance_id: \"7638570949330964203\" (instance_name: VM_INSTANCE_NAME)\n project_id: \"\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\"\n zone: \"\u003cvar translate=\"no\"\u003eVM_ZONE\u003c/var\u003e\"\n }\n type: \"gce_instance\"\n }\n severity: \"NOTICE\"\n timestamp: \"2023-08-06T23:43:07.407511786Z\"\n }\n ```\n\nMonitor boot integrity with Shielded VM\n---------------------------------------\n\nYou can also take advantage of Secure Boot and Measured Boot, features of\n[Shielded VM](/compute/shielded-vm/docs/shielded-vm), to monitor your\nConfidential VM instance's integrity.\n\n### Secure Boot\n\nSecure Boot helps ensure that the Confidential VM instance's system only runs\nauthentic software by verifying the digital signature of all boot components and\nending the boot process if signature verification fails. Firmware that is signed\nand verified by Google's Certificate Authority establishes the root of trust for\nSecure Boot, which verifies your VM's identity and checks that it is part of\nyour specified project and region.\n\nSecure Boot is not enabled by default. To learn how to enable this feature and\nfor more information, see [Secure Boot](/compute/shielded-vm/docs/shielded-vm#secure-boot).\n\n### Measured Boot\n\nMeasured Boot is enabled by a Confidential VM instance's Virtual Trusted Platform\nModule (vTPM) and helps guard against malicious modifications to the instance.\nMeasured Boot monitors the integrity of a Confidential VM instance's bootloader,\nkernel, and boot drivers.\n\nDuring Measured Boot of a Confidential VM instance, `PCR[0]` (a\n[platform control register](https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12))\nis extended with a vendor-specific event, `GceNonHostInfo`, that encodes that\nSEV is in use.\n\nMeasured Boot is enabled by default in new Confidential VM instances. Learn more\nabout [Measured Boot](/compute/shielded-vm/docs/shielded-vm#measured-boot).\n\nWhat's next\n-----------\n\n- Learn how to\n [set alerts on integrity validation events](/compute/docs/instances/integrity-monitoring#setting-alerts)\n and\n [determine the cause of boot integrity validation failure](/compute/docs/instances/integrity-monitoring#diagnosing-failure).\n\n- [Learn about one approach to automating responses to integrity monitoring events](/compute/shielded-vm/docs/automating-responses-integrity-failures)."]]
