gce/ERR/2021_004
Serial logs don’t contain Secure Boot error messages.
Product: Compute Engine
Rule class: ERR - Something that is very likely to be wrong
Description
The messages: “Security Violation” / “Binary is blacklisted” / “UEFI: Failed to start image” / “UEFI: Failed to load image” in serial output usually indicate that the Secure Boot doesn’t pass its pre-checks.
Google Security team may update the UEFI default dbx to implement blacklists based on UEFI revocation list files in response to published CVEs.
Remediation
Make sure that you don’t use outdated images or images with known security issues.