DET-C13: Public IP added to the workload Confidential VM¶
addAccessConfig attached an external (one-to-one NAT or direct IPv6) address to the workload VM, exposing a TEE workload that should only be reached from inside its network.
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space |
| Group | cloud |
| Log source | Cloud Audit Logs · Compute |
| Related check | CSPACE-VM-01: Confidential VM runs SEV-SNP with Shielded boot |
Fires when¶
compute.instances access-config change AND a public natIP added to the workload CVM
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.