Chapter 6. Configuring RHEL on Public Cloud Platforms with AMD SEV SNP

1. Initialization and measurement: A SEV-SNP enabled hypervisor sets the initial state of a VM.

   1. This hypervisor loads firmware binary into the VM memory and sets the initial register state.
   2. AMD Secure Processor (SP) measures the initial state of the VM and provides details to verify the initial state of the VM.

2. Firmware: The VM initiates the UEFI firmware. The firmware might include either stateful or stateless Virtual Trusted Platform Module (vTPM) implementation.

   1. Stateful vTPM maintains persistent cryptographic state across VM reboots and migrations.
   2. Stateless vTPM generates a new cryptographic state for each VM session without persistence.
   3. Virtual Machine Privilege Levels (VMPL) technology isolates vTPM from the guest.
   4. VMPL offers hardware-enforced privilege isolation between different VM components and the hypervisor.

3. vTPM: For stateful vTPM implementation, the UEFI firmware might perform remote attestation.

   1. This depends on your cloud service provider. The attestation decrypts the persistent state of vTPM.

   2. vTPM also measures facts about the boot process

      • Secure Boot state
      • Certificates used for signing boot artifacts
      • UEFI binary hashes

4. Shim: When the UEFI firmware finishes the initialization process, it searches for the extended firmware interface (EFI) system partition.

   1. The UEFI firmware verifies and executes the first stage boot loader from there.
   2. For RHEL, this is shim. The shim program allows non-Microsoft operating systems to load the second stage boot loader from the EFI system partition.
   3. shim uses a Red Hat certificate to verify the second stage boot loader (grub) or Red Hat Unified Kernel Image (UKI).
   4. grub or UKI unpacks, verifies, and executes Linux kernel and initial RAM filesystem (initramfs), and the kernel command line.
   5. This process ensures that the Linux kernel loads in a trusted and secured environment.

5. Initramfs: In initramfs, vTPM information automatically unlocks the encrypted root partition in case of full disk encryption technology.

   1. When the root volume becomes available, initramfs transfers the execution flow to the root volume.

6. Attestation: The VM tenant gets access to the system. They can perform remote attestation to ensure the VM is an untampered Confidential Virtual Machine (CVM).

   1. Attestation is performed based on information from the AMD SP and vTPM.
   2. This process confirms the authenticity and reliability of the initial CPU and memory state of the RHEL instance and the AMD processor.
7. TEE: This process creates a Trusted Execution Environment (TEE) to ensure that booting of the VM is in a trusted and secured environment.

Procedure

1. Get ID of a RHEL AMI if SEV-SNP is not enabled:

   $ aws ec2 describe-images \
   --owners 309956199498 \
   --query 'sort_by(Images, &Name)[*].[CreationDate,Name,ImageId]' \
   --filters "Name=name,Values=RHEL-10*" \
   --region us-east-1

   ...
   "RHEL-10.0_HVM-amd64-..",
   "ami-0a1b2c3d4e5f67890"
   ...

   Warning

   Do not modify the command option --owners 309956199498. This is the account ID for displaying Red Hat images. If you need to list images for AWS GovCloud, use --region us-gov-west-1 and --owners 219670896067.

2. Launch a RHEL instance with AMD SEV-SNP enabled:

   $ aws ec2 run-instances \
   --image-id <example-rhel-10-ami-id> \
   --instance-type m6a.4xlarge \
   --key-name <example_key_pair_name> \
   --subnet-id <example_subnet_id> \
   --cpu-options AmdSevSnp=enabled