[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eIntegrity monitoring, available for both Shielded and Confidential VMs, utilizes Cloud Monitoring and Cloud Logging to track and report on the state of VM instances.\u003c/p\u003e\n"],["\u003cp\u003eConfidential VMs have integrity monitoring enabled by default, but you can modify settings, including Secure Boot, vTPM, and integrity monitoring itself, through the Shielded VM options.\u003c/p\u003e\n"],["\u003cp\u003eEach boot of an AMD SEV-based Confidential VM generates a launch attestation report event, which can be viewed in Cloud Logging and includes details like integrity check results and SEV policy.\u003c/p\u003e\n"],["\u003cp\u003eSecure Boot and Measured Boot are features of Shielded VM that can be used with Confidential VM instances to ensure software authenticity and monitor for malicious modifications, with Measured Boot being enabled by default in new instances.\u003c/p\u003e\n"],["\u003cp\u003eThe integrity validation events can be viewed and have alerts set on them, you can also learn how to automate responses to integrity failures.\u003c/p\u003e\n"]]],[],null,["# Monitor Confidential VM integrity\n\nIntegrity monitoring is a feature of both\n[Shielded VM](/compute/shielded-vm/docs/shielded-vm) and Confidential VM\nthat helps you to understand and make decisions about the state of your VM\ninstances. It makes use of both [Cloud Monitoring](/monitoring/docs) and\n[Cloud Logging](/logging/docs).\n\nIntegrity monitoring is enabled by default on new Confidential VM instances. To\nlearn how to change integrity monitoring settings---including toggling\nSecure Boot, vTPM, and integrity monitoring itself---see\n[Modifying Shielded VM options](/compute/docs/instances/modifying-shielded-vm).\n\nView integrity reports\n----------------------\n\nYou can use Cloud Monitoring to view integrity validation events and set\nalerts for them, and Cloud Logging to review the details of those events.\n\nTo learn how to view integrity validation events and set alerts on them, see\n[Monitoring VM boot integrity by using Monitoring](/compute/docs/instances/integrity-monitoring#monitoring).\n\nView launch attestation report events\n-------------------------------------\n\nEach time an AMD SEV-based Confidential VM instance boots, a launch attestation\nreport event is generated as part of the integrity validation events for the VM.\n\nThe report event contains the following useful information:\n\n- `integrityEvaluationPassed`: The result of an integrity check performed by\n the Virtual Machine Monitor on the measurement computed by SEV.\n\n- `sevPolicy`: The SEV policy bits set for this VM. Policy bits are set at\n Confidential VM instance launch to enforce constraints, such as whether debug\n mode is enabled.\n\nTo view a launch attestation report event in an integrity report, complete\nthe following steps:\n\n1. In the Google Cloud console, go to the **VM instances** page.\n\n [Go to VM instances](https://console.cloud.google.com/compute/instances)\n2. In the VM instances table, find your Confidential VM instance and then click\n its name.\n\n3. In the **Logs** section, click **Cloud Logging**.\n\n4. Cloud Logging opens, and the integrity report populates with integrity\n validation events for the given time range. You might need to change the\n time range of the log (next to the **Search all fields** box) to capture the\n boot events.\n\n5. Find a report that has a type of `cloud_integrity.IntegrityEvent` and a\n `bootCounter` of `0`, and then expand it.\n\n To view the data for a specific field, click the\n arrow_right expander arrow. To expand\n all fields, click **Expand nested fields**.\n6. Inside the `jsonPayload` key, look for the `sevLaunchAttestationReportEvent`\n key to view the report event. Expand following widget for an example of a\n typical integrity report.\n\n #### Integrity report example\n\n ```gdscript\n {\n insertId: \"0\"\n jsonPayload: {\n @type: \"type.googleapis.com/cloud_integrity.IntegrityEvent\"\n bootCounter: \"0\"\n sevLaunchAttestationReportEvent: {\n integrityEvaluationPassed: true\n sevPolicy: {\n debugEnabled: false\n domainOnly: false\n esRequired: false\n keySharingAllowed: false\n minApiMajor: 0\n minApiMinor: 0\n sendAllowed: true\n sevOnly: true\n }\n }\n }\n logName: \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/logs/compute.googleapis.com%2Fshielded_vm_integrity\"\n receiveTimestamp: \"2023-08-06T23:43:09.422303036Z\"\n resource: {\n labels: {\n instance_id: \"7638570949330964203\" (instance_name: VM_INSTANCE_NAME)\n project_id: \"\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e\"\n zone: \"\u003cvar translate=\"no\"\u003eVM_ZONE\u003c/var\u003e\"\n }\n type: \"gce_instance\"\n }\n severity: \"NOTICE\"\n timestamp: \"2023-08-06T23:43:07.407511786Z\"\n }\n ```\n\nMonitor boot integrity with Shielded VM\n---------------------------------------\n\nYou can also take advantage of Secure Boot and Measured Boot, features of\n[Shielded VM](/compute/shielded-vm/docs/shielded-vm), to monitor your\nConfidential VM instance's integrity.\n\n### Secure Boot\n\nSecure Boot helps ensure that the Confidential VM instance's system only runs\nauthentic software by verifying the digital signature of all boot components and\nending the boot process if signature verification fails. Firmware that is signed\nand verified by Google's Certificate Authority establishes the root of trust for\nSecure Boot, which verifies your VM's identity and checks that it is part of\nyour specified project and region.\n\nSecure Boot is not enabled by default. To learn how to enable this feature and\nfor more information, see [Secure Boot](/compute/shielded-vm/docs/shielded-vm#secure-boot).\n\n### Measured Boot\n\nMeasured Boot is enabled by a Confidential VM instance's Virtual Trusted Platform\nModule (vTPM) and helps guard against malicious modifications to the instance.\nMeasured Boot monitors the integrity of a Confidential VM instance's bootloader,\nkernel, and boot drivers.\n\nDuring Measured Boot of a Confidential VM instance, `PCR[0]` (a\n[platform control register](https://link.springer.com/chapter/10.1007/978-1-4302-6584-9_12))\nis extended with a vendor-specific event, `GceNonHostInfo`, that encodes that\nSEV is in use.\n\nMeasured Boot is enabled by default in new Confidential VM instances. Learn more\nabout [Measured Boot](/compute/shielded-vm/docs/shielded-vm#measured-boot).\n\nWhat's next\n-----------\n\n- Learn how to\n [set alerts on integrity validation events](/compute/docs/instances/integrity-monitoring#setting-alerts)\n and\n [determine the cause of boot integrity validation failure](/compute/docs/instances/integrity-monitoring#diagnosing-failure).\n\n- [Learn about one approach to automating responses to integrity monitoring events](/compute/shielded-vm/docs/automating-responses-integrity-failures)."]]
