GKE cluster shielded nodes should have integrity monitoring enabled
This control ensures that GKE clusters shielded nodes integrity monitoring is enabled. Enabling Integrity Monitoring for Shielded GKE Nodes is necessary to be notified of inconsistencies during the node boot sequence.
Enabling Integrity Monitoring for Shielded GKE Nodes is necessary to be notified of inconsistencies during the node boot sequence.
What this control checks
GKE cluster nodes pass or fail based on their shielded instance integrity monitoring setting
Common pitfalls
Default of true means the check passes
As the default is true, this is a pass.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_shielded_instance_integrity_monitoring_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_72; KICS query "Beta - Shielded GKE Node Do Not Have Integrity Monitoring Enabled" (4b5ee6a4-5682-4725-8a7a-d9e9a51986c8).
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-09 (Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their...), ID.RA-09 (The authenticity and integrity of hardware and software are assessed prior to acquisition and use.), PR.DS-10 (The confidentiality, integrity, and availability of data-in-use are protected.) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle.
- ID.RA-09
- PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected.
- PR.IR-02
- PR.IR-03
2 more clauses
- PR.PS-01
- PR.PS-03
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_shielded_instance_integrity_monitoring_enabled - Checkov Check:
CKV_GCP_72 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_shielded_instance_integrity_monitoring_enabled - KICS Query:
4b5ee6a4-5682-4725-8a7a-d9e9a51986c8
Last reviewed: 2026-10-09