7.3. Configuring a RHEL VM on Azure with AMD SEV SNP
AMD Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) is a security type of the Confidential Virtual Machine (CVM) technology for Red Hat Enterprise Linux (RHEL) on Azure Virtual Machines (VMs) and available only for AMD EPYC processor family. SEV-SNP provides a trusted boot environment so that the entire process becomes secured and protected such that hypervisor and cloud service provider cannot access the data.
Prerequisites
-
You have installed the
opensshandopenssh-clientspackages. - You have installed the Azure CLI utility. For details, see Installing the Azure CLI.
- You have launched the instance only from the mentioned Azure instance types. For details, see Supported VM sizes for CVM.
Procedure
Log in to Azure by using the Azure CLI utility:
$ az loginCreate an azure resource group for selected availability zone:
$ az group create --name <example_resource_group> --location eastusDeploy a RHEL instance with SEV-SNP, for example, the
Standard_DC4as_V5instance type:$ az vm create --resource-group <example_resource_group> \ --name <example-rhel-10-sev-snp-instance> \ --image <RedHat:rhel:10_x64_Gen2:latest> \ --size <Standard_DC4as_V5> \ --admin-username <example_azure_user> \ --generate-ssh-keys \ --security-type ConfidentialVM \ --os-disk-security-encryption-type DiskWithVMGuestStateConnect to the RHEL instance:
$ ssh <example_azure_user>@<example_ip_address_of_VM>
Verification
Check kernel logs to verify status of SEV-SNP:
$ sudo dmesg | grep -i sev... [ 0.547223] Memory Encryption Features active: AMD SEV [ 4.843171] kvm-guest: setup_efi_kvm_sev_migration : EFI live migration variable not found ...