> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Compute instances confidential computing enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure That Compute Instances Have Confidential Computing Enabled" for Google Cloud Platform (GCP) using GCP console, follow the below steps:

        1. Open the GCP Console and navigate to the Compute Engine page.
        2. Select the instance(s) for which you want to enable Confidential Computing.
        3. Click on the "Edit" button at the top of the page.
        4. Scroll down to the "Confidential Computing" section and select the checkbox next to "Enable Confidential VMs".
        5. Click on the "Save" button at the bottom of the page to save the changes.

        Once you have completed the above steps, Confidential Computing will be enabled for the selected instance(s) in GCP.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Ensure That Compute Instances Have Confidential Computing Enabled" for GCP using GCP CLI, you can follow the below steps:

        1. Open the Cloud Shell in the GCP console.

        2. Run the following command to enable Confidential Computing for the specific instance:

        ```
        gcloud beta compute instances update INSTANCE_NAME --confidential-computing
        ```

        Replace `INSTANCE_NAME` with the name of the instance for which you want to enable Confidential Computing.

        3. Verify that Confidential Computing is enabled for the instance by running the following command:

        ```
        gcloud compute instances describe INSTANCE_NAME --format="get(confidentialComputing.enable)"
        ```

        Replace `INSTANCE_NAME` with the name of the instance for which you enabled Confidential Computing.

        If the output of the command is `True`, then Confidential Computing is enabled for the instance. If the output is `False`, then you need to troubleshoot and ensure that the command was executed correctly.

        By following these steps, you can remediate the misconfiguration "Ensure That Compute Instances Have Confidential Computing Enabled" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure That Compute Instances Have Confidential Computing Enabled" for GCP using Python, you can follow the steps given below:

        1. First, you need to create a new instance with Confidential Computing enabled. You can do this using the following Python code:

        ```python theme={null}
        from googleapiclient import discovery
        from oauth2client.client import GoogleCredentials

        credentials = GoogleCredentials.get_application_default()
        service = discovery.build('compute', 'v1', credentials=credentials)

        project = 'your-project-id'
        zone = 'us-central1-a'
        instance_name = 'your-instance-name'
        machine_type = 'n2d-standard-2'

        config = {
            'confidentialInstanceConfig': {
                'enableConfidentialCompute': True
            }
        }

        instance_body = {
            'name': instance_name,
            'machineType': f'zones/{zone}/machineTypes/{machine_type}',
            'confidentialInstanceConfig': config
        }

        request = service.instances().insert(project=project, zone=zone, body=instance_body)
        response = request.execute()

        print(response)
        ```

        2. Once the new instance is created, you can migrate your workload to this new instance. You can use tools like CloudEndure or manually migrate your workload.

        3. Finally, you need to delete the old instance without Confidential Computing enabled. You can do this using the following Python code:

        ```python theme={null}
        from googleapiclient import discovery
        from oauth2client.client import GoogleCredentials

        credentials = GoogleCredentials.get_application_default()
        service = discovery.build('compute', 'v1', credentials=credentials)

        project = 'your-project-id'
        zone = 'us-central1-a'
        instance_name = 'your-old-instance-name'

        request = service.instances().delete(project=project, zone=zone, instance=instance_name)
        response = request.execute()

        print(response)
        ```

        Note: Before deleting the old instance, make sure to take a backup of any data or configuration that you might need.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_compute_instance" "CONFIDENTIAL_VM" {
          name         = "CONFIDENTIAL_VM_NAME"          # Replace with your instance name
          project      = "PROJECT_ID"                    # Replace with your project ID
          zone         = "ZONE"                          # Replace with the desired zone
          machine_type = "MACHINE_TYPE"                  # Use a Confidential VM–supported type (e.g. "n2d-standard-4")

          boot_disk {
            initialize_params {
              image = "BOOT_DISK_IMAGE"                  # e.g. "projects/debian-cloud/global/images/family/debian-12"
            }
          }

          network_interface {
            network    = "NETWORK_NAME"                  # Replace with your VPC network
            subnetwork = "SUBNETWORK_NAME"               # Replace with your subnetwork
          }

          confidential_instance_config {
            enable_confidential_compute = true
          }

          # Any other arguments you already use (labels, metadata, service_account, etc.)
        }
        ```

        Enabling `confidential_instance_config.enable_confidential_compute = true` on an existing non-confidential VM forces replacement of the instance (destroy and recreate), which may cause downtime; plan this change accordingly.

        To verify, `terraform plan` should show an update (or replacement) to the `google_compute_instance` with `confidential_instance_config.enable_confidential_compute: false → true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>