DET-C15: Confidential VM disk snapshotted or imaged¶
A snapshot, image or machine image captured the workload Confidential VM's disk. The disk holds the workload's state, so copying it out of the instance lifts that state out of the VM's confidential boundary and its access controls — the GCP peer of the AWS (DET-22) and Azure (DET-A7) disk-exfil detections.
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space |
| Group | cloud |
| Log source | Cloud Audit Logs · Compute |
| Related check | CSPACE-VM-01: Confidential VM runs SEV-SNP with Shielded boot |
Fires when¶
compute disks.createSnapshot / snapshots.insert / images.insert (sourceDisk) OR machineImages.insert (sourceInstance) captures the workload VM's disk/instance
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.