Azure Confidential VM options on AMD
Azure Confidential Computing offers multiple options for confidential VMs that run on AMD processors backed by AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) technology.
Sizes
You can create confidential VMs that run on AMD processors in the following size families:
Size family | Description |
---|---|
DCasv5-series | Confidential VM with remote storage only. No local temporary disk. |
DCadsv5-series | Confidential VM with a local temporary disk. |
ECasv5-series | Memory-optimized confidential VM with remote storage only. No local temporary disk. |
ECadsv5-series | Memory-optimized confidential VM with a local temporary disk. |
Note
Memory-optimized confidential VMs offer double the ratio of memory per vCPU count.
Azure CLI commands
You can use the Azure CLI with your confidential VMs.
To see a list of confidential VM sizes, run the following command. Replace <vm-series>
with the series you want to use. For example, DCASv5
, ECASv5
, DCADSv5
, or ECADSv5
. The output shows information about available regions and availability zones.
vm_series='DCASv5'
az vm list-skus \
--size dc \
--query "[?family=='standard${vm_series}Family'].{name:name,locations:locationInfo[0].location,AZ_a:locationInfo[0].zones[0],AZ_b:locationInfo[0].zones[1],AZ_c:locationInfo[0].zones[2]}" \
--all \
--output table
For a more detailed list, run the following command instead:
vm_series='DCASv5'
az vm list-skus \
--size dc \
--query "[?family=='standard${vm_series}Family']"
Deployment considerations
Consider the following settings and choices before deploying confidential VMs.
Azure subscription
To deploy a confidential VM instance, consider a pay-as-you-go subscription or other purchase option. If you're using an Azure free account, the quota doesn't allow the appropriate number of Azure compute cores.
You might need to increase the cores quota in your Azure subscription from the default value. Default limits vary depending on your subscription category. Your subscription might also limit the number of cores you can deploy in certain VM size families, including the confidential VM sizes.
To request a quota increase, open an online customer support request.
If you have large-scale capacity needs, contact Azure Support. Azure quotas are credit limits, not capacity guarantees. You only incur charges for cores that you use.
Pricing
For pricing options, see the Linux Virtual Machines Pricing.
Regional availability
For availability information, see which VM products are available by Azure region.
Resizing
Confidential VMs run on specialized hardware, so you can only resize instances within the same family. For example, if you have a DCasv5-series VM, you can only resize to another DCasv5-series instance type.
It's not possible to resize a non-confidential VM to a confidential VM.
Disk encryption
OS images for confidential VMs have to meet certain security and compatibility requirements. Qualified images support the secure mounting, attestation, optional confidential OS disk encryption, and isolation from underlying cloud infrastructure. These images include:
- Ubuntu 20.04 Gen 2
- Ubuntu 22.04 Gen 2
- Windows Server 2019 Gen 2
- Windows Server 2022 Gen 2
For more information about supported and unsupported VM scenarios, see support for generation 2 VMs on Azure.
High availability and disaster recovery
You're responsible for creating high availability and disaster recovery solutions for your confidential VMs. Planning for these scenarios helps minimize and avoid prolonged downtime.
Deployment with ARM templates
Azure Resource Manager is the deployment and management service for Azure. You can:
- Secure and organize your resources after deployment with the management features, like access control, locks, and tags.
- Create, update, and delete resources in your Azure subscription using the management layer.
- Use Azure Resource Manager templates (ARM templates) to deploy confidential VMs on AMD processors. There is an available ARM template for confidential VMs.
Make sure to specify the following properties for your VM in the parameters section (parameters
):
- VM size (
vmSize
). Choose from the different confidential VM families and sizes. - OS image name (
osImageName
). Choose from the qualified OS images. - Disk encryption type (
securityType
). Choose from VMGS-only encryption (VMGuestStateOnly
) or full OS disk pre-encryption (DiskWithVMGuestState
), which might result in longer provisioning times.
Next steps
Feedback
Submit and view feedback for