Strengthen VM instances with BIOS to UEFI upgrade

You can strengthen your cloud security by modernizing your virtual machine (VM) instances from legacy basic input/output system (BIOS) systems into modern unified extensible firmware interface (UEFI)-enabled Shielded VM instances. Migrate to VMs modernization process enhances security and operational efficiency by securing the boot process.

Shielded VMs offer robust protection against threats by securing the boot process. For more information about threats to the boot process and using Shielded VMs to secure cloud workloads, see Use Shielded VMs to strengthen cloud security .

Before you begin

Before you begin this task, complete the following prerequisites:

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project : Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project : To create a project, you need the Project Creator role ( roles/resourcemanager.projectCreator ), which contains the resourcemanager.projects.create permission. Learn how to grant roles .

Go to project selector

Verify that billing is enabled for your Google Cloud project .

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project : Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project : To create a project, you need the Project Creator role ( roles/resourcemanager.projectCreator ), which contains the resourcemanager.projects.create permission. Learn how to grant roles .

Go to project selector

Verify that billing is enabled for your Google Cloud project .

1. Ensure you have existing VM instances to migrate to, or create new VM instances .
2. Ensure that the following Identity and Access Management roles are granted. For more information, see Grant the required permissions .
   1. VM Migration Administrator
   2. VM Migration Service Agent

Costs

This tutorial uses the following billable component of Google Cloud:

• Compute Engine

Review the pricing pages for each service to understand potential costs. You can also use the Google Cloud Pricing Calculator to generate a cost estimate based on your projected usage.

Migrate and modernize VM instances

The following sections describe how you can onboard, replicate, and configure your VM instances for BIOS to UEFI conversion, and Shielded VM deployment.

For a more comprehensive understanding of migrating a VM instance to Google Cloud using Migrate to VMs, see Migrate individual VMs .

Onboard your source VM instance

The first phase of migration is to onboard the source VM instance. Onboarding is the process of selecting the VM instances that you want to migrate to Google Cloud. For example, your data center might contain tens, hundreds, or even thousands of VM instances. Onboard only the VM instances that you want to migrate.

1. In the Google Cloud console, go to the Migrate to VMspage.

   Go to Migrate to VMs

2. Select the Sourcestab.

3. Choose your migration source from the list.

4. Ensure the source status is Active (connected). If the status of your VM instances is Offlineor Pending, troubleshoot and fix the issue.

5. Select one or more VM instances to migrate from the list.

6. Click Add Migrations > VM Migration.

7. Confirm the action. The replication status shows Pendingor Ready.

Start replication

Replication is a continuous process that replicates data from the source VM instance to Google Cloud. This process continues in the background until you perform a final cut-over or stop the migration.

To start replicating your source VM, follow these steps:

1. Go to the Migrationstab.

   Go to Migrate to VMs

2. Find VM instances with replication status Ready.

3. Select one or more VM instances.

4. Click Migration > Start Replication.

5. Monitor the replication progress. The first sync performs a full disk snapshot and may take time. The Activestatus indicates ongoing incremental sync every two hours.

Convert BIOS to UEFI

To convert your VM instance from BIOS to UEFI, follow these steps. Migrate to VMs performs the BIOS to UEFI conversion during the instance adaptation process.

1. Open the Migrate to VMspage in the Google Cloud console.

   Go to Migrate to VMs

2. Go to the Migrationstab.

3. Select one or more VM instances from the list.

4. Click Edit target details.

5. In the side panel, configure the Compute Engine target settings.

6. To enable BIOS to UEFI conversion, set the Boot modeto UEFIin the advanced settings to automatically convert BIOS to UEFI during migration.