DET-C2: Confidential VM launched from the debug image or with log redirect¶
A Confidential Space VM booted the confidential-space-debug image (SSH, debug attestation) or with tee-container-log-redirect, which streams workload output out of the TEE.
| Property | Value |
|---|---|
| Severity | critical |
| Platform | GCP Confidential Space |
| Group | tee |
| Log source | Cloud Audit Logs · Compute |
| Related check | CSPACE-VM-01: Confidential VM runs SEV-SNP with Shielded boot |
Fires when¶
compute.instances.insert AND (debug/non-CC image OR serial-log redirect) AND instance == workload
How it runs¶
untrust detect --platform sev-snp reads the project's Cloud Audit Logs over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.