GKE clusters should have shielded nodes enabled
GKE cluster nodes must be launched with Shielded VM enabled. The attribute `enable_shielded_nodes` must be set to `true`. Shielded GKE Nodes provide strong, verifiable node identity and integrity.
Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of GKE nodes and should be enabled on all GKE clusters.
What this control checks
GKE clusters must set enable_shielded_nodes to true; false fails.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_shielded_nodes_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_71; KICS query "Shielded GKE Nodes Disabled" (579a0727-9c29-4d58-8195-fc5802a8bdb4); Trivy check GCP-0055.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.IR-02 (The organization's technology assets are protected from environmental threats.), PR.IR-03 (Mechanisms are implemented to achieve resilience requirements in normal and adverse situations.), PR.PS-01 (Configuration management practices are established and applied.) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.IR-02
- PR.IR-03
- PR.PS-01
- PR.PS-03
- PR.PS-05
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kubernetes_cluster_shielded_nodes_enabled - Checkov Check:
CKV_GCP_71 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_shielded_nodes_enabled - KICS Query:
579a0727-9c29-4d58-8195-fc5802a8bdb4 - Trivy Check:
GCP-0055
Last reviewed: 2026-10-09