Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 7. Configuring a RHEL instance on Amazon Web Services with AMD SEV SNP

You can configure AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) on Red Hat Enterprise Linux (RHEL) instances on Amazon Web Services (AWS) to create a trusted boot environment.

SEV-SNP is a security feature of confidential virtual machines (CVMs). SEV-SNP aims to protect your data from access by the hypervisor and cloud service provider, and is available only for the AMD EPYC processor family.

Prerequisites

  • You have installed the awscli2, openssh, and openssh-clients packages.
  • You have created an AWS EC2 instance using an AMD EPYC processor-based machine type from the supported list. For details, see supported instance types.

Procedure

  1. Check if SEV-SNP is enabled for the RHEL instance: 

    $ aws ec2 describe-instances --instance-ids <example_instance_id> \
--region <example_region>
    Copy to Clipboard Toggle word wrap 
    ...
"CpuOptions": {
"CoreCount": 2,
"ThreadsPerCore": 2,
"AmdSevSnp": "enabled"
},
...
    Copy to Clipboard Toggle word wrap

  2. If SEV-SNP is not enabled, get ID of a RHEL Amazon Machine Image (AMI): 

    $ aws ec2 describe-images \
--owners 309956199498 \
--query 'sort_by(Images, &Name)[].[CreationDate,Name,ImageId]' \*
--filters "Name=name,Values=RHEL-10" \*
--region us-east-1 \
--output table
    Copy to Clipboard Toggle word wrap
    Note

    Do not modify the command option --owners 309956199498. This is the account ID for displaying Red Hat images. If you need to list images for AWS GovCloud, use --region us-gov-west-1 and --owners 219670896067.

  3. Launch a RHEL instance with SEV-SNP enabled: 

    $ aws ec2 run-instances \
--image-id <example-rhel-10-ami-id> \
--instance-type m6a.4xlarge \
--key-name <example_key_pair_name> \
--subnet-id <example_subnet_id> \
--cpu-options AmdSevSnp=enabled
    Copy to Clipboard Toggle word wrap

Verification

  • Check kernel logs to verify status of SEV-SNP: 

    $ dmesg | grep -i sev
    Copy to Clipboard Toggle word wrap 
    ...
[    7.509546] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP
[    8.469487] SEV: Using SNP CPUID table, 64 entries present.
[    9.433348] SEV: SNP guest platform device initialized.
[   33.314380] sev-guest sev-guest: Initialized SEV guest driver (using vmpck_id 0)
...
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top