1. Secure Boot

Secure Boot is a Unified Extensible Firmware Interface (UEFI) feature that forestalls unauthorized boot loaders and operating systems from booting. Secure Boot validates that the signed firmware’s signature is correct before booting to stop rootkits, boot kits, and unauthorized software packages from running before the OS loads.
Rootkits are low-level malware that runs in kernel mode. Bootkits change the system bootloader and the system boots with the bootkit instead of the bootloader. Rootkits and bootkits have equivalent privileges as the OS and can record functions like keystrokes and native sign-ins.

2. Measured Boot

Measured Boot is complementary to Secure Boot. To provide the strongest security, enable both Measured Boot and Secure Boot. Secure Boot ensures that each component in the boot process features a signature that’s in the list of valid signatures. Measured Boot allows you to track boot measurements so as to know what firmware you’ve got and when it changes.
Measured Boot enhances boot security by storing measurements of boot components, like bootloaders, drivers, and operating systems. The first time you boot a shielded instance, Measured Boot uses the initial measurements to make a baseline. The baseline measurements also are referred to as golden measurements.

It uses a Trusted Platform Module (TPM) to store its measurements firmly.

3. Trusted Platform Module

Trusted Platform Module (TPM), a specialized security chip utilized by Measured Boot to store the boot measurements. On VM instances, once you change Measured Boot, the trusted Platform Module is instinctively enabled, as TPM is essential by Measured Boot.
Measurements taken by Measured Boot are kept in Platform Configuration Registers (PCRs) within the TPM. A PCR is also a memory location inside the TPM used to hold a value that summarizes all the results that were given to it in the order they were presented.